fix: enforce fee-payer sponsor policy

[mablr]

Description

Implements server-side policy checks before mpp-rb cosigns Tempo fee-payer envelopes.

Closes OSS-303; a client-controlled fee-payer envelope could smuggle policy-violating fields into the sponsored transaction.

Changes

• Add FeePayerPolicy for Tempo sponsor limits.
• Reject client-supplied feeToken; sponsor now sets it during cosign.
• Reject non-max nonce keys.
• Reject excessive gas, fee, total fee budget, and validity windows.
• Reject priority fee greater than max fee.
• Reject non-empty access lists.
• Reject extra or mismatched calls when the original charge request is available.
• Preserve happy-path cosign behavior for valid fee-payer envelopes.

Tests

• Added coverage for:
  • gas policy rejection
  • max fee policy rejection
  • priority fee policy rejection
  • validity window rejection
  • extra call rejection
  • access list rejection
  • valid envelope cosign
• Local syntax checks passed:
  • ruby -c lib/mpp/methods/tempo/intents.rb
  • ruby -c lib/mpp/methods/tempo/fee_payer_policy.rb
  • ruby -c test/mpp/methods/tempo/test_transaction.rb

[cla-assistant]

All committers have signed the CLA.