feat(phase2): IntentRank matching + ZK provenance circuit + poi-subscription program

[Timwal78]

Phase 2: IntentRank + ZK Provenance + POI Subscription

This PR replaces the conflicted #1 with a clean branch based on current main HEAD (a3a39d02), incorporating all supply-chain hardening changes already merged to main.

What's in this PR

Deliverable	File(s)
IntentRank SDK	packages/sdk/src/intentrank.ts, packages/sdk/test/intentrank.test.js
ZK provenance circuit	circuits/provenance.circom, circuits/reference.mjs, circuits/reference.test.mjs, circuits/package.json, circuits/build.sh, circuits/README.md
poi-subscription Anchor program	programs/poi-subscription/Cargo.toml, programs/poi-subscription/src/lib.rs
Anchor.toml	Adds poi_subscription program ID to localnet + devnet
CI	Merged supply-chain pinned hashes + cargo test -p poi-subscription + new circuits JS job
Docs	docs/PHASE2.md, updated README.md

IntentRank algorithm

Reputation-weighted scoring:

score = Σ(value · proofQuality · recencyDecay) / (1 + Σ(severity · decay))

rankServices(candidates, opts) returns candidates sorted descending by score with DID tie-break for determinism. 8 tests in packages/sdk/test/intentrank.test.js.

ZK Provenance circuit (Groth16)

commitment = Poseidon(apiResponseHash, timestamp, salt)
nullifier  = Poseidon(privateKey, intentHash)

Pure-JS reference implementation (circuits/reference.mjs) + 7 tests covering determinism, hiding, identity/intent binding, and replay detectability.

poi-subscription Anchor program

4 tiers via SOL transfer + on-chain expiry tracking:

Tier	Cost
Scout	0 SOL (free)
Runner	5 SOL
Relay	25 SOL
Builder	50 SOL

Note on Cargo.lock

Cargo.lock needs a poi-subscription entry added (7 lines after the poi-gossip entry). The entry is:

[[package]]
name = "poi-subscription"
version = "0.1.0"
dependencies = [
 "anchor-lang",
]

Since CI runs without --locked, cargo will auto-resolve this and CI should pass. Please run cargo update -p poi-subscription locally before merge to commit the updated lock file.

---

🤖 Generated with Claude Code
https://claude.ai/code/session_01RyKH8i6w34HcLA3HGBzfQn

---

Generated by Claude Code