Implement verification states, time locks and required consensus rules

[aagbotemi]

Summary

Implement the spec's three-state verifier output, time lock support for full signatures, explicit enforcement of the required consensus rules, and spec-compliant prevout resolution for proof of funds.

Rebased on #71

Changes

• Add Verification enum (Valid { time, age } / Inconclusive).
• Add internal InputVerification for per-input outcomes.
• Add LockParams to set nLockTime and nSequence on to_sign.
• All verify_* functions now return Result<Verification>, with the invalid state reported as Err.

Notes for reviewers

• Uninterpretable scripts (taproot script-path spends, non-multisig witness scripts, unknown script types) report Inconclusive rather than erroring.
• The upgradeable version rule (nVersion must be 0 or 2) is checked after input verification, so a required-rule failure (e.g. bad signature) still reports invalid even on an unsupported version.
• LockParams version is derived — 2 when any lock is set, else 0, so an inconsistent version can't be constructed. Threaded through sign_full, sign_full_encoded, sign_pof, sign_pof_encoded and create_to_sign. The simple variant keeps all-zero locks per the spec.
• Resolve proof-of-funds prevouts from PSBT UTXO fields instead of a caller-supplied parameter. Proof-of-funds prevout resolution includes the spec's same-txid non-witness UTXO fallback.

Closes #72