feat: ILedgerLensScore composability interface

[Manuel1234477]

Summary

Defines and implements the ILedgerLensScore composability interface — a stable, versioned ABI that third-party Soroban protocols (AMMs, lending markets, DEX aggregators) can target as the canonical LedgerLens integration point, instead of reverse-engineering get_score and risking silent breakage on any future change.

What's included

• query_risk_gate(wallet, asset_pair, gate_threshold) -> bool — the integration primitive. Infallible, never-panics, side-effect-free. Returns true only when a score exists and is strictly < gate_threshold; false on >= or no score (fails closed — unknown wallets treated as risky). Backed by a new TTL-preserving storage::peek_score read so it has zero observable side effects when called cross-contract.
• supports_interface(capability) -> bool — runtime capability registry (score, history, batch, gate, aggr) so callers feature-detect instead of hardcoding version numbers.
• docs/interface-spec.md — canonical spec: signatures, exact RiskScore/AggregateRiskScore XDR field layout, versioning policy, stable error-code table + guarantees, security rationale, integration patterns (gate-on-threshold, cache-with-TTL, fallback on ScoreNotFound, feature-detect).
• examples/amm_gate.rs — reference LedgerLensGatedAmm contract demonstrating the swap guard-clause pattern, registered as a lib-crate-type [[example]].
• src/test_interface.rs — interface stability suite: gate semantics (safe / risky / at-threshold / no-score), capability registry, RiskScore XDR round-trip, error discriminant stability, and a 1000-input never-panics fuzz.
• README — new Composability section with the AMM pattern; documents the new functions; fixes stale RiskScore snippets that were missing model_version.

Security considerations

• query_risk_gate returns bool (not Result) and is engineered to never panic, so it cannot be used to grief a calling protocol's gas or disable its guard.
• The ScoreNotFound case folds into false (conservative default), documented explicitly.
• Capability symbols are append-only within a major version — removing one is a breaking change.

Verification

All CI-equivalent checks pass locally:

• cargo fmt --all -- --check — clean
• cargo clippy --all-targets -- -D warnings — clean
• cargo test --workspace — 60 passed
• cargo build --target wasm32-unknown-unknown --release -p ledgerlens-score — succeeds (33 KB)
• cargo build --example amm_gate -p ledgerlens-score — compiles against the current SDK

Note

The issue's supports_interface prose mentioned "a map of capabilities," but the specified signature takes a single capability: Symbol. I implemented the signature (single lookup → bool), which is what the registry pattern and the required test (supports_interface("score") == true) call for.

Closes #14