Wire the splitter into the action builder

buildPrivateDefi only ever opened one note, so the N-output splitter was
unreachable from the dapp. buildSplit emits one open note per part and
references each by its zero-based ${openNoteIds[i]}, with calldata laid
out exactly as privacy_invoke deserializes it.

Reconciliation is checked client-side before anything is signed — the
contract enforces it too, but failing here keeps the rejection off-chain
and free. Empty splits, splits past the contract's MAX_SPLITS of 16, and
basis points that miss 10000 are all refused the same way.

10 tests, including that a split withdrawing only to the splitter passes
assertNeverUnshields and that an unlisted recipient still throws.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>