Clean port off the nightly-framework dev branch (at/extract-bm): adds the new
`account` package and the Predict account-rewire, on the repo-standard testnet
framework — no nightly `implicit-dependencies`/override pins. Indexer, sims, and
Rust crates are intentionally excluded; this is a Move-only verification branch.

The only nightly-only symbol, `sui::accumulator::create_for_testing` (the sole
`AccumulatorRoot` constructor), is absent from testnet, so the AccumulatorRoot-
dependent tests are disabled behind the single `accumulator_support` seam (no-op
`create_shared_root`): 16 root-only test files renamed `*.move.disabled` (all
`flows/*`, the accumulator smoke test, the two pure-root strike files) plus the
custody/mint/builder-fee tests block-commented in their mixed files. Re-enable when
a stable Sui ships the constructor: restore the seam body + the disabled files.

Green on testnet sui 1.73.1: account 10/10, predict 198/198 (68 predict + 3 account
root tests disabled); both source builds clean under --warnings-are-errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The deleted predict_manager+cap model is replaced by the `account` package
(deterministic shared AccountWrapper + per-call owner `Auth` hot potato):

- run.sh: extract the transitively-published account package id (by the
  `account_registry` module it declares, not published[-1]=predict), the shared
  AccountRegistry, and the AccountAdminCap; authorize PredictApp on the registry
  (mirrors flow_test_helpers); write the account ids into .env.localnet.
- env.ts: export ACCOUNT_PACKAGE_ID / ACCOUNT_REGISTRY_ID.
- runtime.ts: add accountTarget() + a generateAuth() helper; createAccountTx
  (account_registry::new + account::share), depositToAccountTx + supply funding
  via account::deposit_funds, deriveAccountWrapperId (derived AccountWrapperKey),
  and the new mint/redeem/request_supply/request_withdraw signatures (Auth + root
  reordered after the trade primitives). Manager caps and proof minting deleted.
- sim.ts / shared.ts: SimState carries the account wrapper id (caps removed);
  setup creates+funds the account; orchestration comments updated to "account".
  Economic-parity labels (manager_balance/manager_seed) are kept unchanged since
  they are account-agnostic and shared with the Python mirror.

Also fix three pre-existing setup-call signature drifts the sim never caught up
to (the predict contract threaded ProtocolConfig in): registry::mint_lifecycle_cap,
registry::register_underlying, plp::lock_capital.

Verified: tsc --noEmit, bash -n run.sh, and a localnet smoke
(SUI 1.73.1, bash run.sh --sim_max_rows=2) — setup + mint + redeem + supply
+ bootstrap flush all execute, and localnet/Python parity is OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The Sui funds accumulator authorizes a withdrawal from address X only if X is a
transaction-input object. The account delivered/settled funds at the nested
`account_id` UID, which is `derived_object::claim`'d but never instantiated as a
standalone object — so it is never a tx input, and on a real node the settle
aborts with "Unauthenticated funds-accumulator Split" (it panicked the validator
in the localnet sim's first withdraw). Only the shared `AccountWrapper` is a real
input object; the deep `&mut Account` predict threads everywhere can never reach
its UID. (`builder_code` already settles correctly from its own shared-object id.)

Fix — anchor the accumulator on `wrapper.id` and settle at the flow boundary:
- account: `Account` stores `receive_address` (= wrapper address), set in
  `new_derived`. `receive_address()`/`balance()`/`unsettled_balance()` read it. New
  permissionless `settle<T>(wrapper, root, clock)` withdraws via `&mut wrapper.id`
  (authenticates) into stored balance. `deposit<T>`/`withdraw<T>` are now pure
  stored-balance (no `root`/`clock`); `deposit_funds`/`withdraw_funds` settle first.
  `account_id` stays the identity + app-data root.
- predict: each coin-touching entrypoint (mint/redeem/redeem_settled, request_supply
  /request_withdraw, stake/unstake, cancels) calls `account::settle<T>(wrapper, ...)`
  before `load_account_mut`; `root` removed from the now forward-only internals; deep
  `account.deposit/withdraw` drop `root`/`clock`. Public entrypoint signatures are
  unchanged (they keep `root` for the boundary settle), so the simulation is untouched.

Permissionless settle only consolidates the account's own delivered funds into its own
stored balance; pulling funds out still requires `load_account_mut(auth)`.

Verified: account 9/9, predict 198/198 (1.73.1, --warnings-are-errors); sim tsc/bash -n
unchanged; and a 100-row localnet run settles 4 withdraw rows against flush-delivered PLP
with no accumulator panic (the exact failure that previously aborted at the first withdraw).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>