feat(evm): add shielded payment mechanism (privacy pool unshield)

[mmchougule]

Summary

Adds ShieldedEvmClient, ShieldedEvmFacilitator, and ShieldedEvmServer implementing assetTransferMethod: "shielded" for the exact scheme on EVM.

Agents withdraw tokens from an on-chain privacy pool (e.g., Railgun) directly to the merchant's payTo address. The pool contract verifies the ZK proof and checks nullifiers on-chain. The facilitator confirms the resulting ERC-20 Transfer event matches the payment requirements.

Reference implementation uses a deployed privacy pool on Base (Railgun) with on-chain nullifier tracking for double-spend prevention.

Implementation

Client (ShieldedEvmClient): Takes an injected UnshieldFn — SDK-agnostic, any privacy pool works. Calls unshield and returns { txHash }.

Facilitator (ShieldedEvmFacilitator):

• Validates txHash format, checks replay store
• Fetches tx receipt — non-reverted means pool accepted the ZK proof
• Parses ERC-20 Transfer events: from must be a registered pool contract, to must match payTo, value >= required
• Tracks txHash + nullifiers in replay store
• Settle re-verifies before confirming (matches existing EVM/SVM pattern)
• Client-driven settlement — facilitator is verify-only

Server (ShieldedEvmServer): Parses prices, enhances requirements with assetTransferMethod: "shielded" and poolContracts.

Tests

26 unit tests covering:

• Valid payment verification
• Invalid txHash, reverted tx, wrong pool, wrong recipient, wrong amount, wrong token
• txHash replay prevention
• Nullifier replay prevention (defense-in-depth on top of on-chain nullifier set)
• Settle re-verification and settle failure
• Server price parsing and requirement enhancement
• Client payload creation and error propagation

All 365 existing tests still pass.

Files

typescript/packages/mechanisms/evm/src/shielded/
├── types.ts, constants.ts, index.ts
├── client/scheme.ts
├── facilitator/scheme.ts, errors.ts
└── server/scheme.ts

typescript/packages/mechanisms/evm/test/unit/shielded/
├── client.test.ts
├── facilitator.test.ts
└── server.test.ts

Spec: #1951
Closes #1953