feat(sdk): let wasm-sdk and evo-sdk opt into the verified quorum context provider #5652

Browser SDK users (wasm-sdk / evo-sdk) still take Platform quorum public keys from the HTTP quorum service on trust. #5523 adds VerifiedHttpContextProvider in rs-sdk-trusted-context-provider. It proves each key with a DIP 175 getquorumproofchain proof from a checkpoint built into the SDK, so the relay doesn't need to be trusted. So far it has only Rust constructors, though. packages/wasm-sdk/src/context_provider.rs builds TrustedHttpContextProvider in every WasmTrustedContext factory, so browsers have no way to opt in.

What's needed

• A thin wasm-bindgen wrapper in packages/wasm-sdk with explicit verified factories:
  • mainnet / testnet with the embedded checkpoint and the network's public relay;
  • a custom checkpoint (State JSON, the same format as Core's getquorumproofchain target) and relay sources;
  • access to latest_verified_state(), so long-lived apps can save it and pass it back as their checkpoint.
• Wire js-evo-sdk to those factories as an opt-in. The default stays the trusted provider until the default flip below.
• Forward contract registration (register_data_contract or the equivalent) through the wrapper, as the trusted wrapper does.
• No proof, cache or fetch logic in the binding: it only marshals into the Rust provider.
• Browser tests through wasm-sdk, which exercise the fetch transport end to end.
• A wasm32 CI job that runs rs-sdk-trusted-context-provider's wasm-bindgen-test tests (6 today, run locally only) with wasm-bindgen-test-runner.

Later, separately

• FFI / Swift / Kotlin factories.
• Making verified the default, once public mainnet POST /proofs is reachable (it currently returns 403 from CloudFront).

Raised in review of #5523 (#5523 (comment)).