feat(modules): module.toml for twap-monitor + ethflow-watcher (BLEU-834)

[brunota20]

Summary

Per ADR-0001, two manifests:

twap-monitor / module.toml

• `capabilities.required = ["logging", "local-store", "chain", "cow-api"]` — matches the Rust imports the BLEU-826 / -827 / -828 paths exercise.
• `[[subscription]]` log on Sepolia (chain id `11155111`) against ComposableCoW `0xfdaFc9d1902f4e0b84f65F49f244b32b31013b74` with topic-0 = `keccak256("ConditionalOrderCreated(address,(address,bytes32,bytes))")` = `0x2cceac5555b0ca45a3744ced542f54b56ad2eb45e521962372eef212a2cbf361`.
• `[[subscription]]` block on Sepolia for the BLEU-827 poll loop.

ethflow-watcher / module.toml

• Same capability set (`chain` reserved for a future eth_call to read the EthFlow refund pointer, without churning the manifest later).
• `[[subscription]]` log on Sepolia against CoWSwapEthFlow production `0xbA3cB449bD2B4ADddBc894D8697F5170800EAdeC` with topic-0 = `keccak256("OrderPlacement(address,(address,address,address,uint256,uint256,uint32,bytes32,uint256,bytes32,bool,bytes32,bytes32),(uint8,bytes),bytes)")` = `0xcf5f9de2984132265203b5c335b25727702ca77262ff622e136baa7362bf1da9`.

Both `[capabilities.http].allow` lists stay empty — all outbound HTTP flows through the `cow-api` capability (host-pinned orderbook URL).

`component` is the 0.2 placeholder all-zero sha256; 0.3 validates it against the loaded component bytes.

Sequencing

BLEU-834 lives next to (not inside) the skeletons:

• twap-monitor's module.toml lands in `modules/twap-monitor/`, which BLEU-825 (feat(twap-monitor): workspace + skeleton (BLEU-825) #2) creates with Cargo.toml + src/lib.rs.
• ethflow-watcher's module.toml lands in `modules/ethflow-watcher/`, which BLEU-831 (feat(ethflow-watcher): workspace + skeleton (BLEU-831) #8) creates.

The PR branches from `dev/m2-base` so reviewers see just the two manifests. When dev/m2-base accumulates the two skeleton merges, this PR rebases cleanly.

Linear: BLEU-834. Ref ADR-0001.

Test plan

• TOML parses against the engine's `Manifest` schema (`crates/nexum-engine/src/manifest/types.rs`): module / capabilities / capabilities.http / [[subscription]] log + block, with the discriminator `kind` matching the `Subscription` enum's lowercase tag.
• End-to-end `cargo run -p nexum-engine -- target/wasm32-wasip2/release/{twap_monitor,ethflow_watcher}.wasm modules/{twap-monitor,ethflow-watcher}/module.toml` — gated on PRs feat(twap-monitor): workspace + skeleton (BLEU-825) #2 / feat(ethflow-watcher): workspace + skeleton (BLEU-831) #8 (skeletons) being on the same base, plus a Sepolia RPC entry in engine.toml.

[linear-code]

BLEU-834