feat(prs-556): wire deploy-time ABI trust posture into parser_app

[pepe-anchor]

Replaces #441. GitHub refused to retarget that PR ("Cannot change the base branch
because the pull request is part of a stack"), so it is closed in favour of this one
with the correct base. #441 had no comments or reviews.

Why am I making this PR?

Wire the MetadataTrustPolicy from #440 into parser_app so deployments express their posture via cmdline flags instead of inheriting an implicit default.

What am I changing?

Add --accept-unsigned-abis and --accept-signatures-from-pubkey flags to parser_app CLI. Mutually exclusive (clap forbids), at least one required at startup. Parse into ParserConfig.abi_trust and thread through create_registry to the converter.

This commit changes two signatures, create_registry(&ParserConfig) and
parse(req, key, &ParserConfig), so it also carries every call-site update those
break: the grpc-server call site, the library_integration_test example, the
integration-test harness Builder, and the make parser_app target. In the previous
version of this stack those four fixes were scattered across the two commits above,
which left this commit and the one after it uncompilable. That is what #441's red CI
was reporting.

What is the Linear ticket?

PRS-556

What are the rollback steps?

Redeploy with a manifest whose pivotArgs omit the new flags. The old parser_app binary ignores unknown flags.

Is this change backwards compatible?

No. parser_app now refuses to start without an explicit posture. Every launch path (Makefile, integration harness, CI, grpc-server) passes one explicitly as of this commit.

Does this require cross-team/service coordination?

Yes, live deployments need a redeploy to pick up a posture.

How do I know it works as designed? Which tests exercise this code?

CLI arg parsing tests cover both/neither rejection. Registry test pins both postures reach the converter.

Verified at this commit: cargo clippy --all-targets -- -D warnings clean, cargo fmt --check clean, and a full make test passes (previously the integration suite died at startup with "one of --accept-unsigned-abis or --accept-signatures-from-pubkey is required").