[codex] add FlowChain local wallet envelopes

[FlowmemoryAI]

Refs #17, #40.

Summary

Adds the FlowChain private/local wallet and signing layer inside the existing crypto/ package. The PR defines canonical local transaction envelopes with domain separation, chain id, nonce, signer metadata, payload hash, validity window, and secp256k1 signature while preserving payload.tx for the existing devnet transaction model.

It also expands object identity and schema coverage for BridgeDeposit, BridgeCredit, BridgeWithdrawal, and LocalAccountBalance, adds local transaction and wallet public metadata schemas, and records the key/envelope decision in docs/DECISIONS/.

Scope

Allowed folders touched:

• crypto/
• schemas/flowmemory/
• docs/DECISIONS/
• docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md

Forbidden implementation folders were not changed.

Worktree: E:\FlowMemory\flowmemory-crypto

Validation

• npm test --prefix crypto
• npm run validate:vectors --prefix crypto
• npm run validate:local-alpha --prefix crypto
• npm run flowchain:full-smoke --prefix crypto
• npm run flowchain:smoke
• npm run wallet:create --prefix crypto -- --vault .wallet/codex-test-wallet.local.json --label codex-test --force
• npm run wallet:sign --prefix crypto -- --vault .wallet/codex-test-wallet.local.json --out .wallet/codex-test-envelope.local.json --chain-id 31337
• npm run wallet:verify --prefix crypto -- --envelope .wallet/codex-test-envelope.local.json --chain-id 31337
• git diff --check HEAD~1..HEAD

npm run flowchain:smoke required npm install --prefix apps/dashboard first because dashboard dependencies were missing locally.

Notes And Follow-Ups

• The wallet is an encrypted no-value local test vault, not production custody.
• Public metadata exports intentionally contain account IDs, signer IDs, roles, public keys, labels, and nonces only.
• Root wrapper integration for wallet-backed flowchain:init remains a follow-up; the existing root wrapper still writes ignored local operator metadata.
• Bridge objects are local/private testnet accounting commitments only and do not claim production bridge readiness.

HQ Required Review Metadata (2026-05-14)

Issue status: Original #100 lane is closed on GitHub; needs new/open issue if work remains
Worktree / branch ownership: E:\FlowMemory\flowmemory-crypto
Allowed folders: crypto/, schemas/flowmemory/, docs/DECISIONS/, docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md
Forbidden folders: crates/, services/, contracts/, apps/dashboard/, hardware/, unrelated infra
Exact checks recorded:

• npm test --prefix crypto; npm run validate:vectors --prefix crypto; npm run validate:local-alpha --prefix crypto; npm run flowchain:full-smoke --prefix crypto as recorded by PR author; npm run flowchain:smoke; wallet:create/sign/verify commands under crypto; git diff --check HEAD~1..HEAD; GitHub CI checks listed below.
• GitHub CI Repository hygiene: SUCCESS
• GitHub CI Contracts: SUCCESS
• GitHub CI Services and launch core: SUCCESS
• GitHub CI Launch-core acceptance command: SUCCESS
• GitHub CI Crypto: SUCCESS
• GitHub CI Dashboard: SUCCESS
• GitHub CI Local devnet: SUCCESS
• GitHub CI Hardware POC: SUCCESS
  HQ readiness: Draft; merge state DIRTY; close as superseded or refresh against current main and a new/open issue; coordinate bridge schemas with [codex] Build bridge relayer credit handoff smoke #113.

[FlowmemoryAI]

HQ review blocker, 2026-05-14: before merge readiness review, please update the PR body to include the linked issue #100, allowed folders, forbidden folders, worktree path, and exact checks run with results. The current body names allowed folders and worktree, but it needs explicit forbidden-folder text plus local command evidence, including git diff --check.

[FlowmemoryAI]

HQ reconciliation note, 2026-05-14: GitHub now shows linked crypto/wallet issue #100 as closed. Before merge review, please either close this draft if it was superseded by merged main, or refresh the PR body with the exact remaining delta and a new/open issue reference for anything still needed.