fix: address security, UX, and hygiene findings from codebase audit

[LeJamon]

Addresses the punch list from a code-audit pass. Single PR because most items are small (≤20 LOC) and they reinforce each other; the commit message lists every change for reviewers who want a checklist.

Summary

Security

• Wallet seeds are now piped to embedded JS modules via stdin instead of an argv tempfile path. Closes the /proc/<pid>/cmdline leak and the "what if the temp file lingers" failure mode. All 15 embedded JS modules updated to read stdin when invoked with -.
• vault deploy / escrow deploy success output now uses maskSeed() (was cleartext). deploy already did.
• PBKDF2 iterations bumped 100k → 600k (OWASP 2023 baseline). New Iterations field on the keystore so we can bump again later without breaking forward compat; v1 keystores without the field still decrypt via legacy fallback.
• Wallet resolver tries the keystore first, so names like swap-vault are no longer misclassified as raw seeds.
• File modes tightened: project .wallets/ 0700, ledger-daemon PID 0600, cached JS modules 0644.
• bedrock node stop polls for exit and SIGKILLs after 2s if SIGTERM is ignored, instead of silently removing the PID file.

Correctness / UX

• bedrock init --primitives contract,escrow,vault actually splits on commas (was rejecting commas despite the docs).
• bedrock build / deploy / etc. now work from a subdirectory — config loader walks upward for bedrock.toml and chdirs to the project root.
• bedrock node logs is implemented via the Docker SDK (was a "not yet implemented" stub). Supports --follow and --tail.
• Docker platform derived from runtime.GOARCH instead of hardcoded linux/amd64 — Apple Silicon no longer pulls an unused amd64 image when an arm64 one is available locally.
• The --verbose persistent flag is now wired through; removes three // TODO: get from global flag sites in call.go / deploy.go / escrow.go.
• --network default unified to local across the mutation commands (deploy, call, vault, escrow, modify, delete, user_delete, clawback) — used to be a mix.

Error handling

• rustup target add failures now surface instead of being swallowed.
• Ledger-daemon cmd.Wait() errors are written to the daemon log.
• Ledger-service startup warnings go to stderr, not stdout.

Docs / hygiene

• README: clone URL xrpl-bedrock/bedrock → XRPL-Commons/Bedrock, Go 1.21 → 1.24, node logs documented as implemented, --network default updated.
• go mod tidy (drops unused btcsuite/btcutil).
• .gitignore: /bedrock binary, tasks/, coverage outputs, .vscode/.

Tests / CI

The repo had zero _test.go files and no test job. This PR adds:

• .github/workflows/ci.yaml — go vet, go test -race, go mod tidy check, and golangci-lint on ubuntu + macos.
• .golangci.yml — errcheck, govet, ineffassign, staticcheck, unused, gofmt, goimports, misspell.
• 21 unit tests across pkg/wallet, pkg/config, pkg/jade, internal/cli covering the highest-leverage paths (encrypt/decrypt round-trip, v1 → v2 keystore upgrade, resolver heuristic, upward config walk, drops/XRP precision incl. >int64 range, maskSeed property test).

Test plan

• go build ./...
• go vet ./...
• go test -race ./... (21 tests pass)
• go mod tidy clean
• Smoke-tested the stdin pipeline on one embedded module (clawback) — reaches the require('@xrpl-commons/xrpl') step, confirming argv→stdin plumbing works.
• End-to-end manual run of bedrock init, bedrock node start/stop/logs, bedrock vault deploy, bedrock escrow deploy against a local node (reviewer's environment).
• Verify CI workflow runs green on first push.