spec: add shielded EVM payments for exact scheme (privacy pools)

[mmchougule]

Summary

Adds specs/schemes/exact/scheme_exact_evm_shielded.md — a new assetTransferMethod: "shielded" for the exact scheme on EVM chains.

Enables privacy-preserving x402 payments where the payer's wallet address is hidden behind a ZK proof verified on-chain by the privacy pool contract. The facilitator confirms the resulting ERC-20 Transfer event matches the payment requirements.

How it works

On-chain (privacy pool contract handles):

• Client generates a groth16 ZK proof proving ownership of a shielded UTXO
• Proof includes nullifiers that mark the UTXO as spent (double-spend prevention)
• Pool contract verifies the proof, checks nullifiers, executes the ERC-20 transfer
• If the tx succeeds, the ZK proof was valid and funds are transferred

Facilitator verification:

• Client sends txHash in PAYMENT-SIGNATURE header
• Facilitator fetches tx receipt (non-reverted = pool contract accepted the proof)
• Checks ERC-20 Transfer event: from is registered pool contract, to matches payTo, value >= required
• Tracks txHash to prevent same payment being reused for multiple API calls

Design decisions

• Fits under exact scheme as a new assetTransferMethod — same payment semantics as EIP-3009/Permit2/ERC-7710, different transfer mechanism
• ZK proof verification and nullifier double-spend prevention happen on-chain in the pool contract — facilitator doesn't need to verify proofs
• General — works with any privacy pool that verifies ZK proofs and emits standard ERC-20 Transfer events
• Client-driven settlement — client submits the unshield tx, facilitator is verify-only

Closes #1953