fix: require accepted onchain broadcasts

[ovitrif]

Fixes #1211

This PR keeps Android's on-chain success path conditional on an accepted transaction and blocks fresh spending while a prior broadcast remains unresolved.

Description

• Targets the local com.synonym:ldk-node-android:0.7.0-rc.67 binding generated from LDK Improve Wallet and LDK node business logic handling #113 head 6b60fe0; no release or remote artifact contains this final API yet.
• Keeps sent activity and success UI conditional on an accepted Txid return.
• Queries pending broadcasts and creates a fresh spend atomically on the same LDK service queue; a pending record or query failure blocks transaction creation.
• Preserves failed and timed-out broadcast transaction IDs through wrapped errors and shows persistent acceptance-unknown guidance.
• Gives each Paykit proof preparation a durable ID, allowing a pre-existing pending guard to cancel only the new unassociated preparation.
• Persists an unknown Paykit transaction ID and its replacement lineage while keeping proofData empty.
• Reconciles the generated durable outcome API by any lineage transaction ID: Pending updates the canonical lineage without delivery, Accepted queues only the canonical proof, and Abandoned removes the correlated proof without delivery.
• Acknowledges terminal outcomes only after local proof handling is durable; a durable marker retries failed acknowledgments without duplicate proof delivery.
• Preserves null outcomes and outcome-query failures without delivery or acknowledgment.
• Preserves rejected and not-dispatched outcomes as conclusive failures that do not create sent metadata or activity.

Preview

2026-09-05-android1225-accepted.mp4

2026-09-05-android1225-rejected.mp4

QA Notes

Manual Tests

• 1. Earlier head 66f0fffa used a fresh Android E2E identity and shared regtest fixture for an accepted 1,000-sat send: 23a1ef7f277a777a7be6b2ab1b40c54e2e3e88f8d34e54a4d2b9ccd3a8bc3528 entered the mempool; the success UI and sent activity showed it.
• 2. Earlier head 66f0fffa used deterministic Electrum proxy rejection for a 1,000-sat send: the proxy injected terminal -26 non-final for bbd23b0a9de52acb61ef55d3e1ea4f14f98a964932e93c255a8ee26756f6f191, which returned OnchainTxBroadcastRejected; success UI and a second sent activity were absent, and the mempool was unchanged.
• Current-head manual QA was not run at user direction.

Automated Checks

• LightningServiceTest.kt covers pending guards, pending-query failure, concurrent send serialization, and a later send after a conclusive failure.
• PaykitPaymentProofRepoTest.kt covers durable association, canonical replacement lineage, null and failed outcome queries, Pending, Accepted, Abandoned, and acknowledgment retry without duplicate proof delivery.
• AppViewModelSendFlowTest.kt covers current unknown proof association, pre-existing pending cleanup, persistent guidance, and absence of success.
• TransferViewModelTest.kt covers acceptance-unknown guidance in LSP funding.
• Current-head tests, compile, lint, builds, and device checks were not run at user direction.
• Earlier head 66f0fffa passed just compile, just test, and just lint using the superseded local rc.67 artifact and was installed on a fresh Android emulator.

Dependency

Blocked from merge until ldk-node#113 publishes the regenerated Android binding from head 6b60fe0df32362d6c6604393071110e94a2058b8. No release or tag exists, and the prior remote rc.67 artifact is unsuitable. This PR uses the exact generated BroadcastOutcome API without inferring acceptance from payment details or submitting null-proof records.