fix(node): stop paying the merchant's royalty to our own treasury

[enot3615]

Ports the #42 royalty fix from the Python client to the Node client, five weeks late.

The defect

When a merchant has not named an ip_creator, the Node client filled the royalty slot by reading B2BSplitter.treasury(). The comment argued for it — address(0) would supposedly strand the 1bp in the contract, which has no sweep function.

That is not what the contract does. B2BSplitter._split(), contracts/B2BSplitter.sol:238-244:

if (_ipCreator != address(0)) { ipAmt = _total * ipCreatorBps / D; }
// else: ipAmt stays 0 and is absorbed into merchantAmt below
merchantAmt = _total - treasuryAmt - ipAmt;

With address(0) the royalty is folded into the merchant's leg. Nothing is stranded. So the fallback took 1bp off every payment whose merchant had not set a creator and paid it to our treasury. This is the on-chain source of the 0.01% creator fee QA raised.

Why a test that reads two files

Python was fixed in #42 on 2026-08-27; Node was not touched. A unit test on either client alone passes the whole time — the clients only disagree with each other. node/tests/royalty-parity-with-python.test.ts therefore reads both sources and asserts they resolve the slot the same way. Verified failing on the defect (2 of 4 assertions) before being accepted.

This is the third instance of the same shape this month — one implementation corrected, its twin left alone. The second was gate/src/scope.ts against backend/aifp/scope.js (#50).

Also in this PR

• The dead splitterTreasury() helper and its cache are removed. Leaving the machinery in place is how the defect comes back.
• The Solana branch still routes through treasury in both clients. That is matched and deliberate — the Solana bridges do not surface an ip_creator — and the fourth assertion pins it so nobody "fixes" it for symmetry.

Checks

• Full Node suite 189/189
• tsc --noEmit clean
• No version bump: feat(sdk): generate SPLITTER_ROUTES from the canonical registry, and fail closed on the policy window #40 and chore(release): resolve uuid < 11.1.1 everywhere, SHA-pin CI actions #46 are both moving the agent version and I did not want to collide. Whoever sequences those should fold this in.