Wraith: rounds build change outputs, which breaks exact-denomination locks

[defenwycke]

Audited at f3736bc33.

crates/wraith-protocol/src/single_round.rs builds:

outputs: N x mixed output   value = tier.denomination_sats()
         M x change output  value = input - denom - fee_share, where M <= N
         1 x service fee

Change outputs are linkable to the participant's input, which is the standard weakness this design was meant to avoid.

The agreed model is exact-denomination locks with no change: a preparatory transaction splits funds into denominations, and the sub-denomination remainder is tipped rather than returned as a linkable scrap.

Fix

• Require input.value_sats == denom + fee share exactly at registration.
• Remove the change-output construction path.
• Specify the preparatory split and the remainder tip separately (the prep transaction is visible and marks preparation — that is a known, stated cost).