Introduce the base-intent-swap crate: an in-process service that accepts
signed 1inch Fusion orders and (in later commits) settles them into the
current block.

This commit adds the RPC ingress and configuration. intent_submitOrder
validates order shape and the Dutch-auction window and enqueues accepted
orders; it deliberately does not recover the maker's EIP-712 signature —
the on-chain LOP validates it, and an optional pre-flight
(IntentSwapConfig::verify_onchain_taking, default off) can reject
unfillable orders before signing. Distinct error codes cover malformed
signature, expired auction, invalid order, a full intake queue, and an
unavailable engine. The EOA signing key is redacted from Debug.

The solver engine is the backrunner crate, consumed as a git dependency
pinned by rev to builder-integration main. The tycho / fynd stack it pulls
in pins tycho-common/-simulation/-execution at 0.305.1 in Cargo.lock;
these are load-bearing, as fynd-core 0.81.1 does not compile against the
newer 0.339.x line, so the lockfile must not be regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Add the engine task: it consumes the build-event stream to track the
in-progress block and, on each submitted order, solves it against
committed state overlaid with that block's executed transactions, signs
the resulting settlement, and inserts it into the txpool for same-block
inclusion.

The iteration state machine attributes TxExecuted events by payload id, so
a stale event from a superseded payload job cannot pollute the current
overlay. At block seal or abort the accumulated transactions are cleared:
the sealed block's transactions become committed state and must not be
double-counted, and an aborted job's transactions never landed — so orders
arriving between blocks solve against last committed state.

The settlement nonce is read from the pool's highest transaction for the
signer per candidate (chaining locally within a candidate) rather than a
counter that could permanently desync from pool state. The settlement
stays a typed Recovered<BaseTransactionSigned> from signing through
insertion, recovering the signer from the transaction itself instead of
trusting a separately-threaded address. Inclusion is reported by observing
the builder's own settlement transactions in the event stream, distinct
from pool acceptance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Wire the intent-swap service into the builder. IntentSwapExtension
registers the intent_ RPC namespace and, on node start, spawns the engine
task with a handle to the txpool. If the engine fails to start it panics
rather than returning: reth's critical-task fail-fast only triggers on
panic, and a silently dead engine behind a running builder is worse than a
restart.

A --builder.intent-swap.* CLI group (disabled by default) configures the
service; the flag parsing lives in the builder binary so the cli crate
gains no new dependencies. With the extension disabled the builder behaves
exactly as before — no channel is created and no events are emitted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Document running the service against Base in non-proposing (shadow) mode —
the builder has no built-in shadow flag, so the runbook covers driving it
via op-node / forkchoice replay — and record the load-bearing Cargo.lock
pins (fynd-core 0.81.1's open tycho ranges do not build against 0.339.x).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>