feat: add read-only Solana token risk plugin

[Lcryolite]

Summary

Adds solana-token-risk, a single-purpose T0 WIT tool component that reads a mint through two Solana JSON-RPC calls (getAccountInfo, getTokenLargestAccounts) and returns a bounded authority/concentration summary.

• validates mint input before networking
• reports mint/freeze authority and top token-account concentration
• explains that token accounts are not unique beneficial owners
• has only http_client and config_read permissions
• contains no wallet, signer, transaction, approval, or broadcast code

Validation

• cargo test --locked — 5 passed
• host and wasm32-wasip2 Clippy with warnings denied
• locked WASM release build
• repository component validator passed (host tests, both Clippy targets, build, artifact staging)

Security

README documents the T0 boundary, threat model, RPC endpoint constraint, concentration limitation, and a separate future T1 boundary.