feat(alpha): complete hardening backlog

Complete the alpha-hardening Ralph task set, including tracker billing/accounting guards, validator fraud-audit primitives, wallet binding proof support, documentation runbooks, and updated tests.

Verification: .venv/bin/python -m compileall -q packages tests; .venv/bin/python -m pytest -q --tb=short (313 passed, 3 skipped, 1 failed: tests/test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port because meshnet-node pid 1263451 is already listening on port 7000).

.scratch/alpha-hardening/issues/11-c6-wallet-binding-proof.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 11 — C6: Wallet binding ownership proof + binding overwrite safety
 
@@ -21,10 +21,10 @@ Require signed message from wallet pubkey (ed25519 via `cryptography` / solders)
 
 ## Acceptance criteria
 
-- [ ] Wallet binding requires cryptographic proof of pubkey ownership
-- [ ] One wallet → one API key (or documented admin override)
-- [ ] Gossip `bind` events cannot overwrite existing binding via direct overwrite at `~351`
-- [ ] Tests with deterministic keypairs (local adapter)
+- [x] Wallet binding requires cryptographic proof of pubkey ownership
+- [x] One wallet → one API key (or documented admin override)
+- [x] Gossip `bind` events cannot overwrite existing binding via direct overwrite at `~351`
+- [x] Tests with deterministic keypairs (local adapter)
 
 ## ADR links