Shielded transactions support in block proposer

[l0r1s]

Summary

Companion PR to opentensor/subtensor#2415

Adds MEV shield support to Substrate: shielded (encrypted) transaction handling in the block
proposer, along with the shared primitive and client crates (sp-shield, sc-shield) that were
moved here from subtensor to avoid a circular dependency between the two repos.

Users encrypt their extrinsics using ML-KEM-768 + XChaCha20-Poly1305 against the next block
author's public key. At block building time, the proposer decrypts each shielded transaction and
pushes both the wrapper and the inner extrinsic into the block, keeping transaction contents
hidden from the mempool.

Changes

stp-shield (new subtensor primitives crate)

Shared types used by both the runtime and the node side:

• ShieldedTransaction struct and wire-format parsing
• ShieldKeystore trait and ShieldKeystoreExt runtime extension
• ShieldApi runtime API definition (try_decode_shielded_tx, try_unshield_tx)
• Inherent identifier, ShieldPublicKey type, logging target

stc-shield (new subtensor client crate)

Node-side shield logic:

• MemoryShieldKeystore — in-memory ML-KEM keystore implementation
• ShieldInherentDataProvider — provides the next public key as an inherent
• KeyRotationService — generates and rotates ML-KEM keypairs per slot

sc-basic-authorship (block proposer)

• ProposerFactory / Proposer accept a ShieldKeystorePtr for decryption
• Shielded transactions are detected via the ShieldApi, decrypted, and their inner extrinsic
  is included alongside the wrapper in the produced block
• Block size estimation accounts for wrapper + estimated inner transaction size
• Validators can opt out via SUBSTRATE_SKIP_SHIELDED_TXS=1 — skipped transactions stay in the
  pool for gossip to other authors
• Refactored report_exhausted_resources helper shared between normal and unshielded tx paths

sp-runtime (minor)

• Add fn call() to the Applyable trait (needed to inspect the call after signature check)

pallet-aura (minor)

• Make current_slot_from_digests public for shield key rotation

substrate-test-runtime

• Implement ShieldApi using storage keys (Wasm-compatible) for proposer tests

Tests

[sam0x17]

looks great!