[tompro]

Closes #6.

Problem

Every flow that carves (split/merge) notes and then waits on a settlement poll — send, pay, and inter-mint move — committed the carve's changeset only after the whole flow resolved. A user abort, tab close, or crash during the (up to 2-minute) wait left the carved inputs burned at the mint but spendable locally, and stranded the fresh outputs entirely: their secrets lived only in the pending promise's memory. Observed in the wild with a target mint's Lightning node down.

Fix

• Engine: FundOperationOptions.onCarve — a checkpoint fired by ensureExactAmount the moment a mutation-bearing carve's outcome is known (inputs burned, outputs known), before the flow moves on to the melt/wait. Never fires for a no-op exact-match carve. A rejecting hook aborts the flow before the melt — nothing further is spent from an uncommitted carve.
• Result-shape consequence: because the carve may be committed before the flows' classification rotates run, those rotations no longer rewrite carve.note in the result — PayResult/TransferResult carry a separate verified rotatedNote. (This closes a regression the first cut of this PR introduced: the early-committed carve plus the old in-place rotation would have stranded the returned funds on failed-funds-returned — caught in review, fixed here with tests.)
• Composables (send / pay / move): commit inside onCarve via the existing commitCarve helper; no-mutation carves fall back to a URL lookup; failed-funds-returned adds the rotated note before marking the burned carve note spent.
• NWC: payChangeset adapts to rotatedNote; its commit timing is unchanged (its own early-commit threading is a deliberate follow-up — see below).

Verification

• npx vitest run: 340/340, incl. new coverage: hook fires with the result / never fires for no-mutation carves / hook failure aborts pay and transfer before the melt / hook provably runs before the melt starts / rotation arrives as rotatedNote with the carve untouched.
• npx vue-tsc --noEmit clean, eslint clean, e2e 25/25 (chromium).

Scope notes

• The post-melt abort window (melt issued, wait abandoned) is intentionally not closed here: it is small, reconcilable by refresh, and covered by the ticket's direction 2 (resumable transfers).
• NWC pay_invoice gets its own onCarve threading as a follow-up — flagged by review, deliberately kept out to keep this diff tight.