fix(ttx): merge appendPayload instead of overwriting TokenRequest/Transient

[adecaro]

Summary

Fixes #1913.

Transaction.appendPayload (token/services/ttx/transaction.go) previously merged
a received Payload into the current transaction by wholesale overwrite:

func (t *Transaction) appendPayload(payload *Payload) error {
	// TODO: change this
	t.TokenRequest = payload.TokenRequest
	t.Transient = payload.Transient
	return nil
	// ~25 lines of dead, commented-out merge code
}

This is the single call site used by collectRemote (collectactions.go), invoked
once per action when CollectActionsView collects a transfer action from a remote
counterparty.

Problem

• TokenRequest overwrite: replaced the entire token request instead of merging
  in only new content. Safe today only because the collect-actions responder
  happens to round-trip the initiator's full transaction state before replying — an
  unchecked assumption. A protocol change, a partial/stale responder reply, or
  multiple concurrent/interleaved remote actions could silently drop previously
  collected actions with no error.
• Transient overwrite: unconditionally replaced the initiator's transient map
  with the (typically near-empty) remote one, silently discarding any transient data
  set locally. Currently latent (no in-tree writer populates Transaction.Transient
  yet) but a real bug waiting for its first caller.
• Dead code: the commented-out block referenced payload.Request.Issues,
  TokenInfos, ValidationRecords, and t.Set(...) — none of which exist on the
  current Payload/token.Request model. It predates a request-type refactor and
  could not be reinstated as-is.
• No test coverage for appendPayload, or for collecting more than one action.

Fix

Replaced the overwrite with an explicit, checked merge:

• TokenRequest: if the transaction has no actions yet, adopt the incoming
  request unconditionally (today's normal first-write path, unchanged behavior).
  Otherwise, verify the incoming request's actions are a superset-extension of the
  existing ones (same type + raw bytes, same order, for every existing action) before
  adopting it. A violation now returns an explicit error instead of silently
  corrupting/losing state.
• Transient: entries from the incoming payload are merged in only for keys not
  already present locally — existing values win, so nothing set on the initiator can
  be clobbered by a remote round-trip.
• Deleted the stale, unusable commented-out code.
• Added white-box unit tests (transaction_internal_test.go) covering: first-write
  adoption, superset-extension success, shorter/divergent-prefix violations (both
  error), transient existing-wins merge, transient merge into a nil map, and a
  combined appendPayload merge.
• Documented the merge semantics in docs/services/ttx.md's Collect Actions Flow
  section.

No behavior change for existing single-action integration call sites
(integration/token/dvp, integration/token/fungible swap) — they only ever
exercise the first-write path.

Test plan

• go test ./token/services/ttx/... — new unit tests pass
• make unit-tests-race — no races, ttx package green
• make checks — license/fmt/vet/staticcheck clean
• make lint-auto-fix — 0 issues

🤖 Generated with Claude Code

[AkramBitar]

LGTM.

I added to comments. Please have a look.

[AkramBitar]

LGTM