fix(xmr): S20A - validate quote destinations and unblock the signer

Series context

This is S20A part of the S series tracked in the XMR v3.21.0 launch plan.

• Scope: XMR quote destinations and unsigned local signer retries.
• Depends on: S18/!5037 (merged)’s quote refund validation, already included in the base.
• Follow-ups: the remaining S20 admission/refund address checks, and S21’s memo parsing and refund recovery.
• Full roadmap: !4983 (closed) and https://gitlab.com/thorchain/thornode/-/snippets/6058894.

This covers part of Least Authority’s Issue 5. It does not close the whole issue.

Problem

Quotes can accept integrated or featured XMR addresses that Bifrost’s signing policy rejects. An unsigned outbound to one of these addresses can then keep getting retried at the front of the vault’s signing queue, delaying valid outbounds behind it.

Changes

• Check XMR destinations in swap and limit quotes using the existing supported-address policy. Primary addresses and subaddresses remain supported.
• Check resolved THORName aliases too. This also adds THORName support for XMR limit-quote destinations.
• Apply the same checks to external and contract queries. This changes contract-query behavior and is a consensus-breaking change.
• Remove an unsupported outbound from the local signer queue only when it is unsigned and has no durable signing claim or recovery evidence.
• Keep signed payloads, checkpoints, terminal retries, and observations protected. Recovery and spent-output imports still run first. Storage errors and failed deletion leave the item available for retry.

Removing the local attempt does not mark the payment as complete or cancel the on-chain obligation. THORChain can still reschedule it. Admission checks and handling stranded payments remain separate work.

Testing

• Raw addresses and THORName aliases through both quote paths, including contract queries.
• Real Monero client and signer pipeline tests covering progress to the next valid item, recovery, failed deletion, restart, and redelivery.
• Focused normal-build tests, the full mocknet quote suite, signer/Monero regressions, and focused race checks passed.

The existing normal-build TestQuoteLimitStaleState failure was reproduced on the unchanged base. The mocknet quote suite passes.