feat: canonical expiration transaction script in miden-standards

[partylikeits1983]

Closes #3050. Follow-up to #3028, which added the network-account tx-script allowlist mechanism and explicitly left "defining a frozen canonical expiration script" to a follow-up.

This PR targets next.

What

Adds miden_standards::transaction::ExpirationTransactionScript:

• ExpirationTransactionScript::new(delta: NonZeroU16) - the typed script for a given expiration delta.
• ExpirationTransactionScript::into_parts() -> (TransactionScript, Word) - the compiled script paired with the matching TX_SCRIPT_ARGS so the two cannot be decoupled.
• ExpirationTransactionScript::script_root() -> TransactionScriptRoot - the single allowlistable root, shared by every delta.

The script is the args-driven form:

use miden::protocol::tx

begin
    exec.tx::update_expiration_block_delta
    drop drop drop
end

At tx-script entry the operand stack holds [TX_SCRIPT_ARGS, ..], so the top element is the delta; update_expiration_block_delta consumes it and the remaining three argument elements are dropped. into_parts() returns TX_SCRIPT_ARGS = [delta, 0, 0, 0] alongside the script.

Why args-driven (one root for all deltas)

Reading the delta from TX_SCRIPT_ARGS instead of baking it in means a single MAST root accepts any delta, so every network-account creator can pin the same shared root. This is safe to allowlist on an open network account even though the submitter controls the argument: the kernel only ever lets the expiration delta be tightened, never extended, so the worst a caller can do is make their own transaction expire sooner (see the type docs added in #3028).

Validation

• New example test (scripts/expiration.rs): attaches the script via into_parts() and asserts the tx-args-supplied delta is applied.
• The miden-testing test_auth_network_account_accepts_allowlisted_tx_script_with_caller_args rstest cases (deltas 10 / 30 / u16::MAX) now allowlist and execute this standard script via script_root(), replacing their local copy - exercising the canonical root end to end.

Branch / release

Targets next. Depends on TransactionScriptRoot and the tx-script allowlist from #3028 / #3049, which are present on next.

Follow-ups (not in this PR)

• AggLayer bridge/faucet accounts allowlist ExpirationTransactionScript::script_root().
• Node ntx-builder re-enables its expiration script using this standard script (passing the delta via TX_SCRIPT_ARGS) and the counter-account deploy allowlists the root - see node#2205.

[PhilippGackstatter]

Looks good. I'd just move the script to a different location.

[mmagician]

approved with verbosity nits

[bobbinth]

Looks good! Thank you! I left a couple of minor comments inline.

Also, this should be retargeted into main, right?

[partylikeits1983]

@bobbinth, actually I think I was wrong to assume that this would be easy to rebase back to main. The reason why is because after I addressed @PhilippGackstatter's comment here, this refactor depends on #3055. Doing a cherry pick of #3055 into main would cause a bunch of merge conflicts since that PR did a large refactor of account/interface 😭

Maybe we need to bring main back up to state with next? Or if its not too critical maybe we just wait for this to be available in the next release? Wdyt?

[bobbinth]

Or if its not too critical maybe we just wait for this to be available in the next release? Wdyt?

Yeah, the assumption was that merging this into main is trivial. If that's not the case, then it's fine to merge into next.