fix(bindings): close CI regressions on ci-fixes

[a-shannon]

Context

This is a focused follow-up stacked on #916 (ci-fixes). It incorporates the actionable binding/test findings from Odiseus's review while preserving the upstream 30-second NodeConf default added in 45e4b412.

No dependency manifest or custom timeout API is changed here.

Changes

• Preserve ordinary ES2020 TypeScript consumption of generated WASM declarations while retaining Disposable identity when consumers enable esnext.disposable.
• Restore the typed Python ErgoBoxCandidate constructor stub and exercise it with mypy in Python CI.
• Arbitrate C-core REST completion versus abort through a shared one-shot terminal gate, so repeated or concurrent abort/completion can invoke caller-owned callback state only once without changing the C ABI.
• Remove the iOS main-queue semaphore deadlock, retain and abort the callback request handle on a bounded waiter timeout, and suppress callbacks that arrive after the test has closed.
• Retry Swift public-node operations only for recognized transport availability errors; local, decode, and cancellation failures remain fail-fast.
• Require the Swift and WASM SPV workflows to obtain exactly two proofs from distinct effective node identities (host:port), with deterministic alias/deduplication coverage.
• Add bounded, fail-closed WASM public-node fallback tests and CI checks for the TypeScript/Python contracts.
• Move the Python x86_64 wheel job from the retired macos-13 runner to macos-15-intel.

Related PRs

• ci(ios): make SPV workflow test opt-in #845 makes the iOS SPV workflow opt-in in CI. This PR instead keeps that coverage active, bounds external failures, and preserves the two-source assertion, so the approaches are related but not duplicates.
• Replace core2 with no-std-io2 #863 remains the separate dependency-custody alternative. The explicit exact core3 pin in Dependencies updates for github CI actions #916 removes hidden aliasing/direct semver drift, but does not establish Ergo-controlled custody or eliminate future yank risk.

Validation

• ergo-lib-c-core --features rest: 7 passed, including completion-first, abort-first, repeated abort, synchronous validation ownership, drop semantics, and 128 completion/abort races.
• ergo-lib-c --features rest: consumer test/check passed; Clippy with warnings denied and rustfmt passed.
• TypeScript: 4.5.4, 5.1.6, and 5.9.3 with ES2020, plus 5.9.3 with esnext.disposable.
• Python: mypy constructor fixture passed; 11 unit tests passed.
• WASM deterministic node REST suite: 9 passed.
• Full local browser suite: 58 of 59 executed tests passed. The only failure was the pre-existing devnet-only /info test because no node was running at 127.0.0.1:9053; peer discovery, public NiPoPoW, and the two-proof SPV workflow passed.
• GitHub Actions on c34be562: 27 checks passed, including Swift/iOS, browser JS and generated TypeScript declarations, every Python wheel lane, and macos-15-intel/x86_64. The release job and npm publication steps were skipped as intended for a pull request.
• Swift is not available on the local validation host; the pull-request Swift/iOS job is the executable Swift gate.

Scope

This does not redesign the production Swift async wrappers or change pre-existing panic/runtime-shutdown semantics. It does not select a dependency-custody strategy, merge #916, tag a version, publish packages, or perform a release.