modules: re-point ethflow-watcher onto the venue observe path

[mfw78]

What

Re-point ethflow-watcher off shepherd:cow/cow-api onto the videre videre:venue/client venue-registry observe path (observe-only, no submit). Teach videre-host to watch externally-obtained receipts.

Why

Ethflow observation should ride the generic seam like twap's submit path, removing another legacy cow-api consumer ahead of the cone retirement.

Testing

Full gate green (fmt, check, clippy -D warnings, nextest 826, doctests). The cow-boot invariant test re-homed onto stop-loss (the remaining cow-api module) since both twap and ethflow are now off cow-api.

AI Assistance

Implemented and red-teamed with Claude; the stack-rebase conflict (both re-points obsoleted the cow-boot tests) was hand-resolved.

Closes #328.

[lgahdl]

Clean migration, well cross-checked. The new observe path resolves the venue before touching the watch set (rejecting unknown/dead venues, unit-tested both ways), so it can't waste watch-set capacity on a bogus venue string — receipt content itself stays opaque, same as it always was for submit-sourced receipts, so this isn't a new trust boundary so much as the same pre-existing opacity reached via a second call path. The WIT/trait change is purely additive (observe added, no existing signature touched; VenueTransport::observe has a default Unsupported body so no existing implementor breaks), observe-only is enforced and tested (strategy_never_submits), the shepherd-backtest touch is a necessary, correctly-scoped consequence of on_chain_logs's signature change rather than scope creep, and the re-homed boot-order invariant test on stop-loss mirrors the original line-for-line.

One soft note, not a defect in this diff: after this PR, stop-loss is the only module left on the legacy cow-api cone, and nothing here tracks that final retirement step — worth linking a follow-up issue now so shepherd-cow-host and its test surface don't stay indefinitely maintained for one module with no visible trigger to finish the job. Approving.

[mfw78]

Thanks for the approval. On the soft note: the follow-up you are asking for already exists and is the immediately next car, so no new issue is warranted.

#471 (feat/m4-retire-cow-cone, "cow: retire the legacy cow-api host cone") carries Closes #293, which is open and milestoned M4. It does exactly the two things you name: it deletes crates/shepherd-cow-host in full, all nine files including the tests/cow_boot.rs test surface, and it migrates stop-loss off the cone (Cargo.toml, module.toml, src/lib.rs, src/strategy.rs).

Measured rather than assumed: stop-loss carries 19 cow-api/CowApi references at this car's head and zero at #471's, so it really is the last consumer and it really does go to zero one car later.

So the visible trigger to finish the job is the next merge in this train, not an untracked intention. Nothing left dangling from this PR.