feat: Add xrpl::vault_dust:: overlay, wire dispatchers, relax ValidVault

[Tapanito]

Summary

Third and final slice of the Vault-dust custody design, split out from #7970. Wires the Vault as the sole consumer of DustSplit today, and relaxes ValidVault to accept the extended-balance semantics introduced by scale-refinement dust promotion.

Also lands docs/dust-mechanism.md, which describes the full mechanism (model, DustSplit shape, Override/Drain semantics, reporting sign convention, contract asserts, how to add a new consumer, amendment-gate policy, ValidVault sign-handling).

Stack:

• refactor: Centralize Vault balance mutations in VaultHelpers #7983 — Centralize Vault balance mutations in VaultHelpers (parent)
• feat: Add sfDust field on RippleState #8016 — Add sfDust field on RippleState
• feat: Add DustSplit primitive and thread it through the IOU credit path #8017 — DustSplit primitive and IOU credit path threading
• this PR — xrpl::vault_dust:: overlay, dispatcher wiring, ValidVault relaxation

Each slice ships its own tests. This PR ships the Vault-flow / invariant / integration tests.

Design

xrpl::vault_dust:: overlay

• useVaultDust(view, vault): eligibility gate — featureLendingProtocolV1_1 + VaultVersion::CashBasis + !asset.integral(). Also the dispatcher used by the base xrpl::addVaultAssets / clawbackVaultAssets / removeVaultAssets / moveVaultAssets to route eligible vaults through the vault_dust:: implementations.
• Deposits (addVaultAssets): receiver-leg Override at posteriorScale(vault, valueDelta). Vault reconciles sfAssetsAvailable += split.receiver->balanceDelta, sfAssetsTotal += valueDelta - split.receiver->dustDelta.
• Clawback / non-terminal remove / move: sender-leg Override at scale(sfAssetsTotal_post_op). Vault reconciles the promoted amount (-split.sender->dustDelta) back into sfAssetsAvailable and sfAssetsTotal.
• Terminal remove (FinalRemoval::Yes): sender-leg Drain. sfDust and sfBalance land at zero on the vault's custody line; sfAssetsTotal and sfAssetsAvailable hard-reset to zero.
• No trust-line writes anywhere in vault_dust:: code. Renormalisation is implicit: the credit path re-splits the extended balance on every accountSend under Override mode.

ValidVault relaxation

• DeltaInfo gains a signed dustDelta alongside delta. ttVAULT_WITHDRAW now compares the extended pseudo-account delta (delta + dustDelta) against the destination's extended delta, so a scale-refinement dust promotion (an internal move on the pseudo-account's line) does not spuriously fail "vault and destination balance must change by equal amount".
• O2 dust bounded by one quantum relaxed to 10 × quantum(scale(sfAssetsTotal)) to accept up-to-one-decade drift under Override mode when the caller's ex-ante scale estimate lands on a decade boundary. Drift is caught on the next accountSend.

Wiring

• LoanPay routes through the vault_dust:: overlay when useVaultDust is true.
• VaultDeposit / VaultWithdraw pass the DustSplit through into the base helpers.

Tests

Three suite additions and two augmentations, exercising the overlay, invariant, and wiring together:

• src/test/app/lending/VaultRoundingTrustlineDust_test.cpp — 12 dust-lifecycle tests driven through real transactions (deposits, loan payments, withdrawals, terminal drain, invariant regressions, multi-loan interleaving), guarded by a floor on dust-observing runs so the suite can't go silently vacuous.
• src/test/app/lending/VaultRounding_test.cpp — 16 Vault-facing rounding scenarios (O1-O8 identities, dust accumulation and promotion, scale-crossing, terminal drain, LoanManage::defaultLoan interaction).
• src/test/app/lending/VaultDustProbe.h — shared instrumentation used by both suites to read raw sfDust in the Vault's sign convention.
• src/test/app/VaultHelpers_test.cpp — new "moveVaultAssets: sender-leg Override renormalises, recipients dust-unaware" case for the overlay dispatcher.
• src/test/app/lending/LoanPay_test.cpp — new "broker fee debit shares the borrower's trust line with the vault debit" case for the LoanPay wiring.

Protocol-layer and DustSplit-primitive tests live earlier in the stack (#8016 RippleStateSfDust_test, #8017 DustSplitCreditPath_test).

Extensibility

The DustSplit struct is consumer-agnostic — no Vault-specific fields, no Purpose enum. Enforcement of "Vault-only today" is layered:

1. useVaultDust(view, vault) is the sole caller-side gate today; only vault_dust:: code constructs a DustSplit.
2. directSendNoFeeIOU asserts featureLendingProtocolV1_1 on any non-empty DustSplit.
3. A new consumer (AMM, LoanBroker, …) adds its own eligibility gate, constructs a DustSplit from its transactor helpers, and reconciles its own bookkeeping. No trust-line-layer code changes required per new consumer.

Test plan

• All new suites pass locally (VaultRoundingTrustlineDust_test, VaultRounding_test, VaultHelpers_test, LoanPay_test)
• Existing Vault / Loan suites remain green with featureLendingProtocolV1_1 disabled
• With the amendment enabled, existing Vault / Loan suites remain green

Non-goals

• No changes to Legacy vaults or integral-asset vaults.
• No non-Vault consumers of DustSplit.
• No RIPPLE_STATE field-order changes.
• No amendment-gate changes (still featureLendingProtocolV1_1).
• No Natural DustSplit mode (deferred).

[github-actions]

This PR has conflicts, please resolve them in order for the PR to be reviewed.

[github-actions]

All conflicts have been resolved. Assigned reviewers can now start or resume their review.