nipcash: conformance fixes for provenance, claim checks, envelopes and chunked replies

[naliyi]

Closes #120

Summary

• VerifyProvenance verifies satscash1 tokens under lnd's prefix and reports no provenance for an unknown HRP, instead of a wrong minter.
• CheckClaim returns nipcash.ErrSpent for a tombstone; CashConsolidate errors on an undecryptable delivery.
• transport.Decode drops a malformed item into Envelope.Rejected and keeps its co-items; chunked replies bound total by the items requested and keep decided outcomes.
• Encoders no longer write blank relay entries.
• Adds frozen known-answer and regression tests for provenance, connection_key, the claim-proof kind, cash-target commitments and bill-proof signing.

Test plan

• Each fix's regression test fails on main and passes here.
• Each test-only addition was checked against the mutation it guards (mutant red, reverted green).
• go vet, go mod tidy, gofmt, golangci-lint v2.13.2, go test -race -count=1 ./...