fix(directory): make seller publication restart-safe

[randomblocker]

What & why

Makes the Community Directory /register seller flow safe to use against the live Demos StorageProgram contract. New listings use the SDK #70 next-nonce/empty-salt address convention, and an ambiguous or interrupted broadcast can be resumed without creating or overwriting another immutable listing version.

Changes

• Resolve the deterministic producer-held program name and bind every candidate to the exact on-chain owner before deciding a listing is absent.
• Fail closed on lookup/read ambiguity, duplicates, malformed candidates, or a saturated bounded result page; request a nonce only after proven absence.
• Recover an existing owner-bound listing only after full Listing, IdentityBundle, signature, seller, tuple, and content-hash verification.
• Persist the public signed listing, transaction, coordinates, and unsigned registration before wallet broadcast.
• Re-read and independently verify the exact anchor before catalog registration, including after reload or registration failure.
• Refresh only the catalog registration signing message on resume and clear recovery state only after registration succeeds.
• Clarify required fields, expected wallet approvals, exact recovery coordinates, account-switch recovery, and the active failure stage; block new-listing navigation until recovery state is loaded.
• Preserve the legacy dacs:v1 derivation helper for existing fallback readers; no SDK pin, indexer, gateway, or Standard change is included.

Safety contract

• No automatic transaction rebroadcast occurs from recovery state.
• Uncertainty is never treated as absence.
• A live wallet write was not dispatched while qualifying this change.
• The persisted recovery record contains public signed artifacts and coordinates only, never private keys or wallet secrets.

Validation

• npm run typecheck
• npm test — 201 passed
• CI=1 npm run test:e2e -- --workers=1 — 16 passed
• production deployment-origin check passed
• npm run build passed
• git diff --check passed
• read-only live-node probe: exact synthetic-name lookup returned absent; nonce RPC returned HTTP/RPC 200 with a safe nonnegative value
• SDK feat(directory): clarify service evidence boundaries #70 hardcoded address vector: empty salt stor-225d925e0427753fdea2a5e5ac040d58e7c47ac3; legacy salt remains distinct

Submission checklist

• Changes remain under reference-implementations/dacs-directory/
• README states the seller-publication DACS surface and recovery limitations
• Status is honest: exercises the current Listing surface; SDK feat(directory): clarify service evidence boundaries #70 address derivation is vector-tested
• Hosted CI repeats fresh checkout, pinned-SDK vendor/build, dependency install, typecheck, tests, production build, and browser regressions
• Existing repository license is unchanged
• No secrets, private endpoints, or non-test mnemonics