Add scoped native settlement for opening exposure

[luisleo526]

A native close currently drains the whole position in FIFO order. This change adds an explicit opening-exposure scope, so reducing B by one unit in a book [A:2, B:3] leaves [A:2, B:2]. Every surviving fragment of B's opening request is selected within its exact position cycle, with one execution fee and preserved historical entry costs.

The existing settlement methods keep their signatures and whole-book behavior. New scoped methods share target validation and allocation arithmetic between inspection and settlement; stale owners and selected Transact actions are refused before effects. This is the internal prerequisite for owner-bound orders; resting-order matching and child/group lifecycles remain later R2 work.

Validation at candidate 794d1f2:

• Fresh local Release build and 309/309 CTests passed. The new suite has 12 numerical cases and 3319 checks, including partial/oversized closes, shared opening incarnations, stale cycles, fee/rebate conservation, and a small selected lot beside large unrelated exposure.
• Additive ABI proof passed: all five old and both new methods link, existing layouts/status encodings are preserved, and the wrong-scope negative control fails for the intended symbols. Both existing native/script ABI guards passed.
• Independent Grok review of the complete exact candidate is GREEN. The completed Cloud retry measured 72/72 cases and 4190/4190 probes with zero full-grade, raw-trade, substantive-verifier, coverage or configuration differences against accepted R1. The prior R1 comparison is not claimed as proof for this change.

All nine CI checks on this exact runtime candidate passed. Snapshot b0e03f3b48f6353228d9873b4793c9ce5bb19bc6ec33b75e7786d91a8cff4c3a is published. Actual gate pineforge-pr-gate-m6j9h returned FAIL target.not-positive only: no improvement, no regression. Merge uses the standing neutral-refactor authorization; this remains a FAIL and does not promote the campaign baseline.

The first Cloud attempt ended 71/72 because task15 failed before application startup. Its evidence is retained and the experiment is abandoned; fresh attempt2 completed all 72 cases without code changes. This PR completes the R2a prerequisite, not the full R2 resting-order phase.