offchain: replace the ten git dependencies with path dependencies

[bgm-malbeclabs]

Step 3 of the monorepo migration. Stacked on #4240 and based on that branch, so the diff shown here is step 3 alone. It retargets to main once #4240 merges.

Summary

Ten git dependencies in offchain/Cargo.toml become path dependencies:

• Seven on malbeclabs/doublezero, pinned to client/v0.31.0, now point into crates/, config/ and smartcontract/.
• Three on malbeclabs/doublezero-solana, pinned to revenue-distribution/v0.3.7, now point into solana/.

All ten pins stop existing. That removes the failure of 2026-08-26 as a class: cargo treats a git dependency's URL and revision as part of the crate identity, so two consumers naming the same crate differently build two copies whose types do not unify. It surfaced as 194 errors about methods that plainly existed, with nothing in the error text pointing at the cause.

Both trees are still excluded nested workspaces with their own lockfiles. A path dependency may point outside its own workspace, so this lands before the workspaces merge in step 4. network-shapley-rs stays a git dependency, since it lives in another organization and is out of scope.

The one code change

Flipping the pins moves offchain from client/v0.31.0 to current main: 80 commits and about 150 changed files across the seven packages. Exactly one thing broke, and the contributor-rewards golden tests from #414 are what caught it.

User.feed_pk: Pubkey became feed_pks: Vec<Pubkey> in malbeclabs/infra#2114, and the committed snapshot predates the change. apply_serviceability_json_compat_migrations already backfilled the singular field, so it now folds it into the plural one. The subtlety is that this list serializes as a single comma-separated string rather than a JSON array, the same as its publishers and subscribers neighbors, so an absent feed is the empty string and not an empty array.

The goldens then matched exactly. Moving to current main leaves every computed reward value unchanged, which is the assurance step 1 existed to provide.

Testing Verification

• No git+ source for malbeclabs/doublezero or malbeclabs/doublezero-solana remains in offchain/Cargo.lock. The only git source left is network-shapley-rs, unchanged.
• The contributor-rewards goldens pass and match, so the reward values this repo computes are identical before and after.
• The offchain workspace passes its full suite, zero failures.
• The solana tree is untouched by this pull request and still builds standalone. Its one failing test, test_configure_program, needs make build-sbf to have run first, as solana/README.md documents, and fails the same way on the base branch.
• cargo fmt --all --check and cargo clippy --workspace --all-targets are clean on offchain.

One thing to know for step 4

rust-toolchain.toml is directory-scoped, not workspace-scoped. Building from offchain/ now compiles the root crates with offchain's 1.92.0 toolchain rather than the root's 1.97.1. It works today, and this pull request deliberately leaves it alone. Step 4 resolves it by deleting offchain/rust-toolchain.toml when the workspaces merge, along with the edition trap: all 14 offchain crates declare edition.workspace = true and would silently inherit the root's 2021 instead of their 2024.