Durable nonce guard entrypoint + post-merge fixes

[0xLeo-sqds]

Summary

Adds a custom entrypoint that rejects durable nonce transactions, preventing transaction replay attacks against the smart account program. Also fixes SDK generation and tests broken by the upstream merge of account-utilization, resolved-signer, and policies branches.

Durable nonce guard

Adapted from Febo's nononce program pattern. The guard works at the entrypoint level:

1. Every top-level instruction must append the Instructions sysvar (Sysvar1nstructions1111111111111111111111111) as the last account
2. The entrypoint strips the sysvar from the account list after validation, then forwards the clean accounts to Anchor
3. Validation loads instruction index 0 from the sysvar — if it's SystemProgram::AdvanceNonceAccount, the transaction is rejected with DurableNonceForbidden

Bypass rules

Three discriminators skip nonce validation entirely (no sysvar needed):

Discriminator	Reason
Anchor IDL tag	Anchor internal
Anchor event CPI tag	Anchor internal
LogEvent	Self-CPI for event logging. Stateless (just emits logs), invoked by the program itself via invoke_signed. Safe because the parent top-level instruction already passed nonce validation.

All other self-CPIs (sync execution, settings changes, transaction execution) go through normal instruction paths where the SDK appends the sysvar.

SDK integration

• scripts/add-instructions-sysvar.js — post-generation script that appends the Instructions sysvar to every generated instruction file
• sdk/smart-account/src/instructions/shared.ts — appendInstructionsSysvar() utility for SDK wrappers that push additional keys after the generated instruction (e.g., signers into remaining_accounts)

Other fixes

SDK generation (.solitarc.js)

The ResolvedSigner struct (from resolved-signer merge) introduced nested account groups in the IDL that solita couldn't parse. Added flattenAccounts() to the IDL hook that promotes single-child wrappers (like ResolvedSigner { info: AccountInfo }) to flat accounts while preserving multi-child composites for solita's own prefixing.

executeSettingsTransactionSyncV2 wrapper

Missing appendInstructionsSysvar() call — the wrapper pushes signers after the generated keys, burying the sysvar instead of keeping it last.

Test fixes

• authorityAddSpendingLimit, authorityRemoveSpendingLimit: Added incrementAccountIndex calls before spending limit creation (account-utilization requires unlocking index > 0)
• accountIndexSpendingLimit: Updated assertion — async settings execution path does not enforce AccountIndexLocked
• settingsChangePolicy: Type narrowing for LegacySmartAccountSigner | SmartAccountSigner union
• transactionCreateFromBuffer (v1 + v2): Updated OOM error regex for Solana 3.0.0 format change