fix(cascade): land programmatic Node workflows on master

[mateeullahmalik]

Summary

Lands the already-reviewed sdk-js PR #15 Cascade changes on master.

PR #15 was merged into chore/protos-v1.20.0 shortly after PR #11 had already squash-merged that branch's earlier state into master. GitHub therefore marked #15 merged, but its 13-file runtime diff never reached master.

This PR is a clean cherry-pick of PR #15's implementation commit onto current master. It excludes PR #11's generated-protobuf diff, which is already present on master.

Behavior change

• Adds programmatic ADR-036 signing for OfflineSigner / DirectSecp256k1HdWallet Node workflows.
• Signs the exact Base64 index payload transmitted to and verified by the chain.
• Waits for on-chain ACTION_STATE_DONE after SuperNode upload completion.
• Decodes protobuf-encoded Cascade and Sense action metadata.
• Adds Node download-task polling when browser EventSource is unavailable.
• Avoids using the upload-only task-detail endpoint for download tasks.
• Updates the Node full-workflow example and adds regression coverage.

Rationale

Without these changes, headless Node consumers can fail with signArbitrary is not a function, creator-signature verification errors, premature upload success, protobuf metadata decode errors, or download monitoring failures.

Scope integrity

• Base: current master (bb3b68f)
• Change: PR fix(cascade): support programmatic Node workflows #15 implementation commit only
• Diff: 13 files, 415 additions, 9 deletions
• The resulting source tree is byte-for-byte equivalent to the previously reviewed PR fix(cascade): support programmatic Node workflows #15 branch.

Verification

On this clean master parent:

• pnpm@10.28.1 install --frozen-lockfile — passed
• Vitest — 87/87 passed
• ESM build — passed
• CJS build — passed
• CJS smoke — passed
• ESM smoke — passed
• Bundler smoke — passed

The equivalent source tree also completed a real Lumera v1.20.2 testnet Cascade round-trip: 65,536-byte upload/download with SHA256 equality after on-chain finalization.

Risks

• Polling introduces bounded additional RPC queries while waiting for action finality or Node download completion.
• Programmatic signing must remain byte-compatible with ADR-036 and chain-side verification; deterministic tests cover the sign document.
• No generated protobuf files or dependency versions change here.

Rollback

Revert the single commit from this PR. Browser Keplr/Leap behavior and generated protobuf code are otherwise unchanged.

Migration / upgrade impact

• No on-chain state keys change.
• No migration is required.
• No upgrade handler impact.
• This is a downstream SDK runtime correction for Lumera v1.20.x.

Observability

No new external telemetry. Existing upload/download progress and thrown errors remain the operational signals.

Supersedes the missing-to-master delivery of #15; it does not replace or alter #11.