cleartext: add BIP388 cleartext engine, codegen and CI check

Implements the confusion score and the cleartext representation for a
large subset of commonly used wallet policies. This is the standalone
engine layer: it compiles into the app but is not yet wired into any
handler.

The classifier tables and AST matchers are generated from the TOML specs
in specs/bip388/ by gen.py:
  - specs/bip388/cleartext.toml    -> cleartext_specs.{h,c}, cleartext_match.c
  - specs/bip388/test_vectors.toml -> unit-tests/cleartext_vectors.inc.c
The hand-written runtime (cleartext.c, cleartext_match.h) provides the
scorer/encoder and the primitives the generated classifier calls into.

are_key_placeholders_identical() is exposed from policy.h for use by the
encoder.

A CI job (cleartext-gen-check.yml) runs `gen.py --check` to ensure the
committed generated files stay in sync with the TOML specs.

Mostly ported by Claude from the Rust reference implementation, with
several iterations of review and refinement.