DONOTMERGE: spend an unconfirmed output

[octobocto]

Wallet::select_coins reads the confirmed utxos table only. A user must wait
for a block before the wallet spends the change. A second create_transfer
fails with NotEnoughFunds, or takes the coin the first one spends and fails
with UtxoDoubleSpent.

Four layers stop a chained spend. update_wallet fills the wallet from
State::utxos alone. Wallet::create_transaction and State::regenerate_proof
prove every input against the tip accumulator, which holds no leaf for an
unconfirmed output. State::fill_transaction returns NoUtxo for such an
input. Block validation reads every input from the pre-block UTXO set, so no
block carries a parent and its child.

The wallet keeps the unconfirmed outputs that it may spend. An input that the
mempool holds is no longer a proof target. A block may spend an output that an
earlier transaction in the same body made. --spend-zero-conf-change takes the
wallet's own change only, the way Bitcoin Core's -spendzeroconfchange does, so
an unconfirmed payment from someone else waits for a block. The mempool refuses
a chain of more than 25 transactions. This change is a hard fork: an old node
rejects a block that carries a parent and its child. It does not cover
replace-by-fee, a fee bump, or an orphan pool.

The integration tests fail before this branch runs its own code. The enforcer
submodule pins ca0bd4c, which sends ack_all. The downloaded -latest-
enforcer holds 9cb14bc, which reads that field as a policy enum.