fix: reserve the withheld-fee escrow and fix fee-pool distribution edge cases

[giunatale]

The consumer fee pool doubles as the escrow for downtime-accusation refunds,
but nothing actually reserved the escrowed amounts — plus three smaller
distribution edges.

Quotes and payouts now come from one definition

The fee-claim queries recomputed a claim inline as shares * balance / total,
without reserving the outstanding escrow, while the helper that did apply the
cap had no production caller — so a depositor querying during an open challenge
window was quoted more than a withdrawal would pay. Capping the queries is not
quite enough either: an escrow-limited withdrawal burns whole shares and
re-derives tokens from them, so a naive min(claim, available) can still
over-quote by a truncation unit. Both the withdrawal and both queries now go
through a single feePoolDraw definition, so a quote and a payout cannot
disagree at all.

An unaccounted pool balance can no longer halt a block

The send restriction deliberately exempts the distribution module account
(governance funding routes through it), which means a community-pool spend
addressed straight at a consumer fee-pool address is waved through and creates a
balance no shares account for — exactly the state the restriction exists to
prevent. That state then panicked in three places, one of them reachable from
BeginBlock through consumer deletion, so a governance transaction could arm a
later chain halt; a third site refused to import such a balance, so a state
export taken afterwards could not be restarted. All three now absorb the balance
deterministically, crediting the distribution module account — the same
accounting the proper funding path would have produced, so the funds return to
the community pool on sweep — and log it. Genuine store or codec failures still
panic, so a deletion can never be silently aborted. The consistency invariant
still reports the state, with its godoc explaining that it is reachable and
self-healing.

Escrow reservation

When downtime evidence is accepted, the accused validator's fee share is
withheld and recorded; a successful challenge retro-pays it from the pool. But
ordinary distribution and funder withdrawal operated against the full pool
balance, so the money backing a pending challenge could be spent out from under
it and a proven-innocent validator's refund could bounce.
DistributeConsumerFees and WithdrawShares now operate against
balance - outstandingWithheld, withdrawal caps tokens (not shares) so the
share-accounting invariant holds, and the post-stop sweep deliberately does not
reserve (a stopped consumer's pending slashes are already cancelled, so its
escrow is dead and the full balance is released).

Refunds never pay a matured accusation

PayWithheldFees refunds every record for the consumer. A record whose
challenge window has already elapsed backs a slash that has since matured and
executed; it is now cleared without payment, so a later same-consumer challenge
can never refund an already-slashed validator.

Distribution edges

• A positive per-epoch fee smaller than the bonded-validator count truncated to
  a zero share and skipped both charging and the debt flag — a free epoch. It
  now flags debt; a genuinely zero fee still owes nothing.
• Downtime fee exclusion applies to the epoch the infraction window falls in,
  not the epoch the evidence arrived in: excluding on arrival could dock a
  later epoch the validator was genuinely owed. When the window's epoch has
  already paid out, only the (separately priced) pending slash applies.
• ResolveDowntimeSlashTokens rejects a non-positive photon conversion rate
  (previously only zero); a negative rate would have produced a negative slash.

Testing

Unit coverage for every path above, including the full
exclude -> distribute -> challenge -> refund-paid-in-full sequence, the
truncation debt flag, epoch-targeted exclusion, and the expired-record refund
guard. Build, lint, and the module suite are green.

[giunatale]

Branched from giunatale/feat/offline-detection (#63).
Opened against that branch so only this PR's commit shows; will retarget to main after #63 lands and this rebases.