cow: adopt the Journal guard in the composable-cow keeper submit

[mfw78]

What

Rewire composable-cow's submit_ready onto Journal::guard (#629): the six inline journal.mark/reserve/commit/release calls that carry the #572 reserve-before-effect ordering collapse into one guard call, with the venue outcome mapped to a Disposition (Accepted commits, requires-signing and known refusals release, an unknown outcome retains for reconcile). The Pending path stays outside via poll_once.

Why

This is the reference adoption of the durable-effect guard against the real keeper, and it validates the primitive: behaviour is identical, all 23 composable-cow run tests including w1/w2/w3 and anti_572 pass unchanged.

Honest scope: the diff is net +1 line, not a shrink. The guard absorbs the generic durable-effect ordering; the rest of submit_ready (intent build, the outcome-to-disposition mapping, the refusal clear, the retry ledger, tracing) is CoW-specific and irreducible. The value is that the exactly-once ordering is no longer inlined, so a second venue's keeper reuses it rather than re-deriving the #572-prone dance, not that this keeper got materially smaller.

Testing

nix develop --command just ci green (fmt, clippy -D warnings, doc, module wasms, full workspace test suite incl. the 23 composable-cow run tests under --all-features); just check-venue-agnostic and just check-cow-orderbook-only PASS. The four #572 reconcile tests were run by name and pass.

AI Assistance

Implemented with Claude Code.

Part of #609. Rebased onto dev/m1 now that #629 (the Journal::guard combinator) is merged; the diff is composable-cow only.