feat(cow-venue): dry-run flag on the orderbook adapter

[mfw78]

What

Adds dry-run to the cow-venue adapter [config] (strict "true"/"false", default off, present as an explicit dry-run = "false" in module.toml, module.sepolia.toml, and module.load.toml).

In crates/cow-venue/src/adapter.rs, submit_with assembles and validates the order exactly as live (InvalidBody refusals still refuse) and suppresses only the POST: the signed path returns SubmitOutcome::Accepted with the locally derived orderUid, and the pre-sign path returns the live-shaped RequiresSigning with setPreSignature calldata derived from that uid, so the keeper journal disposition (commit vs release plus unsigned report) matches production on both flows. status_with short-circuits to Open under the flag, so synthetic receipts never drive orderbook reads. Each suppressed post logs the would-be orderUid: CowAdapter::init installs a stderr-backed tracing sink, since the venue world has no logging capability and guest stderr is the channel the supervisor captures and tags. Quotes still go live, and the manifest comment says so.

Why

Closes #664: shadow soak against mainnet must exercise the true path, poll through verdict through journal reserve and commit, with zero external effects. Journal rows identical in shape to live mode validate dedup and expiry behaviour on real traffic before real orders are at stake. The manifest comment records the operational caveat that a committed dry-run marker suppresses the same body's later live submit, so leaving dry-run needs a fresh journal store. The shadow-soak evidence run for #65 is an ops action that follows separately.

Testing

Gates (all via nix develop -c, from the worktree, package-scoped per the train's light-CI rule):

• cargo fmt --check -p cow-venue: clean.
• cargo clippy -p cow-venue --all-targets --features adapter: clean.
• cargo nextest run -p cow-venue --features cow-venue/adapter: 73 passed, 1 skipped (was 68; new: strict parse with default-off, dry-run signed submit asserting zero HTTP requests plus the local uid plus the captured log line, dry-run pre-sign asserting zero requests and RequiresSigning, dry-run refusal of a body the live path rejects, dry-run status reporting Open without polling).
• cargo nextest run -p cow-venue (bare): 16 passed.

AI Assistance: Claude Fable used for the implementation and repair via a structured workflow; Claude Opus used for the red-team review (17 findings deduplicated to 9, all fixed after verification, including the venue world's structural inability to log via the host facade and the pre-sign journal-disposition mismatch).