feat(sdk-core): add root-fetch detour in getUserPrv for safe child wallets

[s84krish]

Ticket: WCN-1200

Summary

• Enable safe owner signing for child wallets whose user key has no encryptedPrv: fetch the root, decrypt with the safe passphrase, and hardened-derive the child (m/999999'/') via shared safeDerivation.ts.
• Add a signing-side accessor (resolveSafeOwnerSigningPrv) with fail-closed multisig pub verification against the registered child pub.
• Wire call sites (getUserPrv, hot-wallet signTransaction, getUserKeyAndSignTssTransaction, pending-approval TSS recreate) without detouring getPrv / getEncryptedUserKeychain (wallet sharing must not receive root material).
• Preserve sharee and SMC behavior: sharees decrypt their child encryptedPrv as-is; soft deriveKeyWithSeed remains for non-safe SMC only.

Test plan

• Unit: safe owner root fetch + hardened derive (not soft deriveKeyWithSeed)
• Unit: pub mismatch aborts locally
• Unit: sharee path — no root fetch, no soft derive (incl. explicit prv)
• Unit: SMC coldDerivationSeed still applied for non-safe wallets
• Unit: fetchRootKeychainForSafeChild rejects non-user root source
• Unit: signing guards + pending-approval safe path use getUserPrv
• Confirm wallet-share / getEncryptedUserKeychain still skips for safe owners (no root exposure)
• E2E multisig send from a safe child (tracked with WCN-1187 / WCN-1206)

[linear-code]

WCN-1200

[davidkaplanbitgo]

just a nit on a test