fix(payout): allow wallet registration while payout pipeline is disabled (#954)

[Augustas11]

Summary

• Mount SPEC-016 §3.3 payout-address challenge/register (and §6.4.1 pause/resume) whenever payout.security.hot_wallet_address is set, even when payout.enabled=false — closes Malibu Change-wallet HTTP 404 (Malibu "Open browser wallet" fails with HTTP 404 — allow payout-address registration while payout pipeline is disabled #954).
• Keep the execution pipeline (runner, signer/KEK, RPC, lease, run-now/abandon/funding/orphans, GET /providers/{id}/payouts) behind payout.enabled=true.
• Amend SPEC-016 to v0.1.26 (registration-only carve-out + pause-before-disable rotation ordering); tighten config/deploy-gate validation; friendlier CLI 404 copy for Malibu.

Test plan

• go test ./internal/payout/ ./internal/config/
• go build ./cmd/coordinator/
• python3 scripts/check_spec_governance.py / gen_spec_index.py --check
• Pearl: set final hot wallet in overlay with payout.enabled=false, restart, confirm journal payout registration-only enabled and challenge returns 401 (not 404)
• Malibu Change-wallet opens browser signer against production coordinator

SPEC-GOVERNANCE-DECLARATION-BEGIN
{
"schema_version": "spec-pr-governance-v1",
"behavior_change": "yes",
"contract_change": "yes",
"specs": ["SPEC-016"],
"requirements": ["SPEC-016-R002"],
"authority_domains": ["payout-lifecycle"],
"arbitration": ["CODE_BUG", "SPEC_BUG"],
"tests": ["phase4-coordinator/internal/payout/registration_only_test.go"],
"journeys": ["JOURNEY-SPEC-016-PAYOUT-ADDRESS-REGISTRATION"],
"issue": "#954"
}
SPEC-GOVERNANCE-DECLARATION-END

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[antfleet-ops]

Approved: registration-only §3.3 mount while payout.enabled=false closes #954; execution pipeline stays gated; audits cleared to 0 CRITICAL/HIGH/MEDIUM.