platform-wallet: send_payment store-failure strands signed inputs; suppressed spends inert across the FFI

[bfoss765]

Found by the 2026-08-19 merged-PR audit (widened by #4373). Two halves:

1. send_payment reservation stranding / clobbering (fund-safety): a persistence failure after signing leaves the signed inputs reserved with no release path, and the unconditional release on the error path can clobber a NEWER reservation — re-exposing the inputs of a possibly-sent transaction to coin selection. The fix threads a reservation token (the pattern already exists at signed_payment_registry.rs:825) so release is conditional on still owning the reservation.
2. Suppressed spends never cross the FFI: the unrecorded_spends derivation now covers all phases engine-side, but the host-visible carry is inert on mobile until the SpentOutPointFFI final-spend ABI flag exists — the heal cannot reach the Kotlin/Swift stores yet. This half should ride the planned ABI batch (final-spend flag, get_dpns_name_state vtable slot, fix(platform-wallet): a partial identity scan is never retried once any identity is on file #4365 scan-state persistence).

A complete fix exists on branch fix/payment-reservation-and-txo-heal (former PR #4425, closed to keep the open-PR queue focused on migration-critical work). Reopen as-is when there is review bandwidth — ideally alongside the ABI batch so half 2 activates.