Serve the current epoch collateral requirement, so a client can show what a margin costs

[MichaelTaylor3d]

Task

Expose the current epoch's collateral requirement over the node control plane, so a client can show
what a safety margin actually costs.

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3173
Blocks the useful half of: DIG-Network/dig-app#298 (PR #301) and
DIG-Network/dig-node#388

Why

The safety-margin setting shipped in dig-app PR #301. It saves and applies correctly — but it cannot
show the cost, because nothing serves the requirement. Verified against
dig-node-control-interface 0.22: no epoch method and no collateral method exists.

A bare "+1%" tells an operator nothing actionable. The entire point of the setting is choosing between
safety and opportunity cost, and that choice cannot be made without the extra $DIG figure at the
current requirement and store count.

The app is honest about it today — it reports the requirement as unknown and confirms the choice
is still saved and applied, rather than computing a cost from an assumed value. That is the correct
behaviour and it should stay correct after this lands: a node that cannot determine the requirement
must still say so.

What to serve

At minimum, the current epoch and its required_per_store. Consider also the census inputs behind it
(store count, owner count, multiplier, handicap), since the per-epoch record already holds them and a
client that can show why the number moved is far more useful than one that shows only the number.

Serve, do not re-derive. The value comes from dig-mirror-collateral via the node's per-epoch
record (dig-node#387). A client must never recompute the requirement — a sibling lane already proved
that re-deriving the formula from spec text reintroduces holes the crate closes structurally.

Two design points that are already settled elsewhere — match them

1. The protocol version belongs in the response. The model is versioned and upgradable, and the
   version that computed an epoch travels with the record. A client showing a requirement without
   knowing which ruleset produced it cannot detect a disagreement.
2. Unknown must be representable. A node that has not yet censused the epoch, or that is behind the
   finality depth, must be able to say so. dig-app already has the pending/known/unknown shape and a
   guard test that exists because a confident zero shipped once before.

The single seam on the app side

collateral_requirement() in crates/dig-app-core/src/confirm/gui/window/pane/settings/mod.rs is the
one function that changes when this method exists. It was written as a seam deliberately — the app
needs no restructuring, only a real source.

Also

• This is a catalog change first (dig-node-control-interface), then a dig-node implementation,
  then adoption — release-first per §4.1. Note that dig-node currently declares 0.21 and does not yet
  serve control.spends.list from 0.22 either (dig-node#385); these two adoptions may be worth doing
  together rather than as two separate version steps.
• Check the error-code space before minting one — dig-node-control-interface#27 records that -32044
  already collides.

Acceptance

dign and the DIG App both show the same requirement for the same epoch, and both say unknown rather
than a number when the node cannot determine it.

[MichaelTaylor3d]

Widen this to carry the safety margin get/set as well — same catalog PR, not two.

Per a user directive, the mirror-coin flywheel is headless and belongs entirely in the node: "the node is the main headless softare that runs, the dig-app is more of a companion."

That makes the node the owner of the safety margin (how much over the epoch requirement it posts), not just the requirement itself. dig-app currently holds a local copy from PR#301; it becomes a remote control instead (dig-app#302), and dign becomes the sole home (dig-node#388).

So this method set is: read the epoch requirement (already scoped here) and get/set margin_bp. Both are needed before the app can show what a margin costs, and both are node state.

Representation is settled — u64 basis points, 100 = +1% — because it is the unit dig_mirror_collateral::apply_safety_margin takes. Do not convert; a unit conversion the two surfaces could perform differently is a money-path drift bug.

[MichaelTaylor3d]

Lane opened. Branch loop/32-collateral-margin, draft PR #33.

• Repo: DIG-Network/dig-node-control-interface
• Worktree: C:\tmp\worktrees\dnci-32, cut from origin/main @ c0a50b4 (v0.22.0)
• DONE: stub commit pushed, draft PR opened.
• NEXT: read method.rs/params.rs/results.rs/error.rs/kats.rs, check the error-code space
  for a free code, then TDD the three methods (requirement read, margin get, margin set).

Design points being matched (settled elsewhere, not re-litigated here):

• margin is u64 basis points (100 = +1%), the unit dig_mirror_collateral::apply_safety_margin
  takes and the one dig-app SPEC.md §3.7b already normatively fixes.
• the collateral protocol version travels with the requirement response.
• "unknown" is representable (not censused / behind finality depth), never a confident zero.

[MichaelTaylor3d]

Implementation complete; PR #33 is DRAFT awaiting the gate round.

• Branch loop/32-collateral-margin, head 5991ff6. Version 0.22.0 -> 0.23.0 (minor, additive).
• cargo test: 168 unit + 9 doc-tests green. cargo clippy --all-targets -D warnings clean.

Shape declared (Category::Collateral, all three shell-owned and token-gated):

• control.collateral.requirement -> tagged union. known carries epoch, protocol_version,
  required_per_store_dig_base_units and the census inputs (stores, owners, multiplier_micros,
  handicap_dig_base_units); unknown carries a reason from not_censused |
  behind_finality_depth | record_unreadable | no_chain_source. No representable value carries a
  figure the node was not given.
• control.collateral.margin.get / .set -> {margin_bp:u64}. Basis points, never converted.
  DEFAULT_SAFETY_MARGIN_BP = 100, MAX_SAFETY_MARGIN_BP = 10_000; above the bound the request is
  REFUSED as -32602, not clamped.

No error code was minted. Existing codes cover every failure, and unknown is deliberately a result
variant rather than an error. The apparent gap at -32045 is NOT free: dig-node/SPEC.md:5877 still
claims it for WALLET_RESERVATIONS_UNAVAILABLE after #28 moved that to -32047.

Blast radius: LOW, purely additive, no symbol edited. The consumer's two dispatch matches key on
&str, not the enum. The one intended reaction is dig-node's
the_node_serves_every_control_method_the_contract_publishes, on adoption.

NEXT: gate round on PR #33. Do not merge, do not undraft until it returns.