CLI: relay deposit confirms to the validator quorum only, stop waiting at quorum

[anderdc]

Stacked on #714 (shares the rejection-renderer changes) — merge that first; GitHub will retarget this to test.

Fixes both halves of the deposit-relay pain from today's mainnet session:

• Slow (A): broadcast_synapse gathered ALL responses on a 60s timeout, so dead/foreign axons held the relay long after the real validator accepted.
• Confusing (B): 5 of 6 serving validators aren't in the contract quorum, can't submit_swap_claim (program rejects NotValidator), and their errors were rendered as if they mattered.

What changed

discover_quorum_axons (dendrite_lite.py): resolves the contract's whitelist to axons — Config.validators → Binding (validator Solana pubkey → hotkey) → metagraph axon — returning only members that fully resolve to a serving axon, plus a hotkey→label map. Verified live on mainnet: AuRf6Y… → 5DtUJ9… → uid 194.

resolve_relay_axons (post_tx.py): uses the quorum set when it covers votes_needed(cfg); otherwise falls back loudly to broadcast-all (yellow warning naming what didn't resolve). The relay can get noisier on a resolution failure — never narrower than the quorum. Both post-tx and the swap now --send pre-resolve path (funds-safety ordering preserved: resolution still happens before money moves) go through it.

Early return: the relay now uses broadcast_until_quorum (the same machinery miner activation has used all along) with needed=votes_needed(cfg) — one accept ends the wait today, and prints Quorum reached — stopped waiting on N slower validator(s). Protocol-safe: attestation is chain-driven (solana_swap_loop scans PendingAttestation from chain state), so quorum members that didn't get the synapse still find the claim.

No failure is papered over: zero accepts → exactly the old path (rejections rendered, 3×30s retry, exit 1). Quorum-member rejections still print in full and still fail the run.

Identity labels: responses render as vali 194: ok instead of V6: ok when the target is known — positional indexes stop meaning anything on a filtered set.

Tests

test_quorum_relay.py (+10): resolution happy path, unbound validator, non-serving axon, partial-resolution fallback, config-read-failure fallback, identity vs positional labels, and a relay_deposit wiring test (quorum count flows through, early-stop line prints). test_swap_now_send_ordering.py updated to the resolver API — the funds-safety invariants (resolve-before-send, recoverable relay errors) still pin.

Full suite: 2057 passed; the 3 test_bitcoin_signing.py failures are the known pre-existing order-dependent set.

Local test plan (before merge)

1. alw swap quote sanity, then a small mainnet swap with --send: expect Relaying deposit to 1 validator(s), vali 194: ok, and a fast relay (no 60s tail).
2. Kill the quorum path deliberately (e.g. ALLWAYS_PROGRAM_ID pointed at a dead program in a scratch config) to see the loud fallback.
3. Standalone alw swap post-tx <sig> re-relay of an already-confirmed deposit (idempotent) to exercise the non---send path.

https://claude.ai/code/session_01QHBu426sa8enr9bYN5gnDX