Versioned apps: end-to-end tests for new failure modes

[imikushin]

Follow-up from PR #170 (versioned apps).

The unit tests added in #170 cover the continuity and consistency rules in isolation. We should add integration tests that exercise the new code paths through is_correct / run_all end-to-end, so that regressions get caught even when the failure mode lives in the seams between layers.

Failure modes worth covering:

• Versioned app whose Wasm binary hash does not match versioned_apps[vk].wasm_hash.
• Versioned app whose __app_version Wasm export does not match versioned_apps[vk].version.
• Versioned app with a Schnorr signature that fails to verify (wrong key, wrong message, tampered bytes).
• Versioned app whose signing public key's SHA-256 does not equal app.vk.
• app_signatures containing an entry whose vk is not referenced by any app in app_public_inputs (extraneous signature).
• versioned_apps containing an orphan vk that no app references (rejected by ensure_no_orphan_versioned_apps).
• Simple app (no versioned_apps entry) with a signature inadvertently supplied for its vk.
• binaries keyed by wasm_hash for versioned apps vs by vk for simple apps — mismatches in either direction.

Suggested layout: build small wasm fixtures (or compile a known app at multiple versions during cargo test) and drive them through ProveSpellTxImpl::validate_prove_request and charms_client::is_correct. Mock proving is fine — we're testing validation, not proof generation.

Referenced in PR #170 review comment: #170 (comment)