feat(wasm-utxo): add CLI support for building and signing Zcash v6 (Ironwood) shielding transactions

[veetragjain]

Adds the transparent -> Ironwood shielding flow to wasm-utxo-cli, and the library support it needs:

• New CLI subcommands: create-zcash-v6, add-shielded-output, sign-v6-input, combine-ironwood-proof. Composed with the existing add-input/add-output, they pipe together into a full build-and-sign flow for a v6 shielding transaction, the same way the transparent-only flow already does.
• ZcashBitGoPsbt::new_v6_bare: an empty v6 PSBT constructor that skips RootWalletKeys xpubs, for standalone tooling (the CLI) that builds/signs one key at a time rather than through a fixed-script wallet.
• ZcashBitGoPsbt::deserialize_v6_pre_shield (+ shared decode_v6 with a require_pczt switch): accepts a v6 PSBT whose transparent skeleton exists but has no Ironwood PCZT yet, since the CLI round-trips a PSBT through serialize/deserialize between each build step rather than holding it in-process.
• combine_ironwood_proof_locally + ironwood_build::create_proof: produce a real Halo2 proof locally (builds a proving key and synthesizes the circuit) instead of requiring an external proof service, so the CLI can finish a broadcast-ready transaction standalone. Gated behind a new orchard-proving feature (pulls in halo2's circuit/proving-key machinery) so the shipped WASM build never links it.
• cli/README.md: documents the new command chain, including a real example that was built, signed, and confirmed accepted by a live Zcash testnet node's mempool.

Ticket: CSHLD-1432

[linear-code]

CSHLD-1432