feat(validator): only issue shares for validated transactions

[sergerad]

Summary

Part 3 of a 4-PR stack formalizing the validator admin API (#2455).

The share endpoint would issue a decryption share over any well-formed ciphertext, acting as an unrestricted decryption oracle.

• Adds PrivateRecordContext::try_from_bytes, a strict parser for the canonical v1 context (domain tag, field lengths, format version, canonical transaction id), with round-trip and rejection tests for every failure path.
• POST /admin/v1/decryption-share parses the transaction id out of the request's decryption context and refuses (404) unless this validator itself validated that transaction. The context is cryptographically bound to the ciphertext, so an arbitrary ciphertext cannot be smuggled under a validated transaction's context. Cross-validator recovery keeps working: every validator in the quorum validated the transaction, and each still issues shares over ciphertexts it does not store.
• map_share_error now matches PrivateRecordError exhaustively, so a new variant — or a golden-ehtdh1 upgrade that introduces a new failure — must be classified rather than silently becoming a 500.

Stack: #2531 → #2532 → #2533 → #2517

Changelog

[[entry]]
scope       = "validator"
impact      = "changed"
description = "The validator admin decryption-share endpoint refuses to issue shares for transactions the validator has not itself validated."