fix(core): reject trailing bytes in manual decoders (#450)

[cryptskii]

What

Closes #450. Three hand-rolled decoders parsed a valid prefix and returned success while silently ignoring
trailing bytes, breaking canonicalization: two distinct wire byte strings could decode to the same value,
enabling signature/representation malleability (a signature verified over a re-derived canonical form would
accept both encodings).

How

Require full byte exhaustion in each decoder:

• Operation::from_bytes — returns Err if any input remains after a complete parse.
• SerializableMerkleProof::from_bytes — returns None unless the cursor consumed the entire buffer.
• SmtInclusionProof::from_bytes — returns None unless offset + count * 32 == data.len().

Safety audit

Swept every from_bytes/decode in dsm/src and every call site of the three decoders across dsm,
dsm_sdk, the JNI bridge, and storage:

• All callers pass exactly-sized buffers (protobuf bytes fields, to_bytes() output, or length-prefixed
  reads), so enforcing exhaustion breaks no caller. Sub-operation decodes are length-delimited, so no inner
  exhaustion check fires.
• All other hand-rolled decoders already exhaust (spv, device_tree, kyber, capsule, smt_replace_witness,
  GenesisHash) or are protobuf/fixed-width (tombstone, policy).
• SmtInclusionProof::from_bytes has no production callers — only unit + integration tests, both passing
  exact to_bytes() output.

Tests / verification

• New trailing-byte rejection tests for all three decoders.
• cargo test -p dsm --lib — 1437 passed.
• cargo test -p dsm_sdk --lib (single-threaded) — 1506 passed.
• cargo test -p dsm --test smt_tripwire_vectors — 25 passed.
• cargo clippy -p dsm -p dsm_sdk --all-features — clean.

Related

• Critical: signed-byte binding not closed — inbox applies field-reconstructed op, not signed bytes #446 (signed-byte binding, PR fix(sdk): bind inbox apply to signed canonical operation (#446) #454) — the inbox fix's per-call canonical equality check already closed
  trailing-byte malleability on that path; this PR closes it globally for all consumers.
• Bilateral BLE prepare: op_id not bound to decoded operation_data (sibling of #446) #453 — bilateral BLE op_id binding (separate track).