feat: offline verification and revocation helpers, client digest fix

[L0STE]

Summary

Three focused, client-side changes — flat in the existing crates/SDK, no new crates, no on-chain changes.

1. Client digest fix (crates/core/src/digest.rs)

advance_vector_digest diverged from the buffer the on-chain program actually hashes, in two ways:

• The instructions sysvar's trailing 2-byte current_instruction_index footer was left zeroed, so any advance not at index 0 (e.g. preceded by a timeout or compute-budget instruction) produced a digest whose signature fails on-chain. The footer is now patched to the advance's index before hashing, matching the TS SDK and the runtime.
• Per-instruction account flags were serialized verbatim, but the live sysvar reflects message-level flag promotion. New advance_vector_digest_with_fee_payer mirrors digest.ts exactly; the 5-arg function keeps verbatim flags for harnesses (mollusk) that serialize per-instruction flags.

2. Offline verification (vector-core::verify, vector-sdk/verify)

Per-scheme verify_advance_signature_* / verifyAdvanceSignature* functions mirroring the signers: recompute the exact digest the program will hash and verify the signature, returning the digest (= the next nonce) on success. Sign-time validation instead of broadcast-time failure discovery — relevant for cold-key flows where a re-sign is expensive.

• High-S ECDSA normalized to match on-chain acceptance; EIP-191 legacy v=27/28 rejected with guidance (normalizeEip191RecoveryByte) since sol_secp256k1_recover requires 0–3
• All five schemes covered, including Falcon-512/Hawk-512
• A deterministic digest constant — with the advance at index 1 — is pinned in both the Rust and TS suites, locking cross-language digest compatibility and the footer fix against regression

3. Revocation helpers

Revocation falls out of the protocol: an inert advance (no pre/post instructions) signed at the outstanding nonce bumps the nonce and orphans whatever was pre-signed against it. This adds the thin helpers — revocation_digest and sign_revocation_instruction_{ed25519, secp256k1_ecdsa, secp256k1_eip191} with TS mirrors — next to the advance signers, so a revocation can be pre-signed in the same session as the transaction it guards and held as a kill-switch.

• The digest commits to the broadcasting transaction's instruction sysvar, so a pre-signed revocation broadcasts as a transaction containing only the advance instruction (fits the default compute budget on ed25519/eip191/secp256k1; Falcon/Hawk sign via the advance path with a compute-budget pre-instruction)
• A mollusk test proves the semantics end to end: revocation lands → the orphaned pre-signed advance fails → replaying the revocation fails
• Cross-language pinned revocation digest constant in both suites

Docs

Readme gains an Operational Patterns section (offline verification, concurrency via one-identity-one-lane, unilateral revocation, ordered pre-signing via digest-as-next-nonce, expiry via in-buffer timeout) and corrects stale content: Passthrough was missing from the instruction table, Hawk-512 registration is three-step (not two), and several SDK listings had nonexistent signatures.

Test results

Suite	Result
cargo test -p vector-tests (mollusk)	28 passed
cargo test -p vector-core	8 passed
cargo check --workspace	clean
bun x tsc	clean
bun vitest run sdk/ts/test/verify.test.ts	11 passed

Note: bare cargo build-sbf at the workspace root fails on a pre-existing getrandom SBF issue (unrelated); per-program cargo build-sbf --manifest-path programs/<scheme>/Cargo.toml works as documented.