fix(xmr): let THORChain-sourced catch-up imports finalize (follow-up to !5055)

What

Follow-up to !5055 (merged).

!5055 (merged) makes every spent-ref import "visible only, not final". That's right for signer and peer imports, but periodic catch-up goes through the same markImportedXMROutboundSigned, so catch-up can't finalize anything either.

The problem

Take a node that learns about a consolidation only through catch-up, e.g. it was offline during the consolidation, or its Bifrost data was resynced. It has no local claim and never observes the tx itself. With !5055 (merged):

1. The catch-up import puts a "committed but not final" marker on the vault's consolidation alias.
2. Nothing on that node ever clears it. The scanner skips the same-vault incoming side, and a ChainCommitted outgoing never becomes a source observation, so OnObservedTxInDurable never runs for that tx.
3. Reserve for the vault's next consolidation then fails with xmr signing claim alias has a different committed unfinalized observation, so the node can't join the next consolidation signing.

Wire-memoless aliases go through the same code (not tested separately).

The fix

markImportedXMROutboundSigned gets a thorchainSourced flag:

• catch-up passes true. Its data comes from THORChain, so it finalizes like it does on develop today.
• applySpentOutputRefsOnce (signer and peer imports) passes false and stays visible-only, exactly as in !5055 (merged).

+20/−6 in client.go, two test call sites, and one new regression test.

Tests

• New TestCatchupConsolidationImportKeepsNextConsolidationReservable: fails at 8f5a132b86, passes on the develop parent 50cb76afcc and with this fix.
• !5055 (merged)'s own tests still pass (TestSpentRefImportKeepsExactBroadcastLiveUntilAuthoritativeObservation, TestStandaloneVisibilityImport*).
• Full bifrost/pkg/chainclients/monero with -tags=mocknet -race and untagged, full bifrost/observer with -tags=mocknet, go vet (mocknet and untagged) and gofumpt: all clean.

Merge plan

This MR targets !5055 (merged)'s branch, so the diff is just this one commit. Two ways to land it:

• merge it into !5055 (merged)'s branch, so it ships together with !5055 (merged), or
• after !5055 (merged) merges, rebase onto develop (git rebase --onto origin/develop 8f5a132b86), retarget to develop, and merge it right after.

If !5055 (merged) lands first, please merge this one soon after. Until then develop has the consolidation lock.

Related

S29(!5121 (merged)) (XMR outbound/spent-ref recovery) is rebased on top of this and routes its THORChain-backed imports through the same flag.