[cli] wire MempoolMonitor into listen loop with pre-sign drain on NewBlock

[obchain]

Track the deferred integration surface for MempoolMonitor.

Scope

Wire charon-scanner::MempoolMonitor into the CLI listen loop:

1. Spawn the monitor task alongside BlockListener, sharing the same RootProvider<PubSubFrontend>.
2. Forward the mpsc::Receiver<OracleUpdate> into a pre-sign builder task once a real signer + deployed liquidator are available.
3. On each ChainEvent::NewBlock, call PendingCache::drain_for_block(block_hash, confirmed_tx_hashes) with the set of tx hashes confirmed by the new block. Feed each returned UnverifiedPreSigned into the executor's simulation gate and broadcast only on SimulationVerdict::Ok.
4. Add metrics hooks once charon-metrics merges (see the TODO(charon-metrics) in run_once).

Non-goals

• Actually broadcasting pre-signs; the signer + liquidator contract wiring is tracked separately.
• Replacing BlockListener — the monitor is additive.

Acceptance

• CLI listens on both streams concurrently.
• drain_for_block is called with a real confirmed-tx set, not an empty one.
• No pre-sign reaches eth_sendRawTransaction without a successful eth_call simulation first (CLAUDE.md safety invariant).

[obchain]

Fixed on feat/21-mempool-monitor (d21d4a6): CLI now spawns MempoolMonitor alongside BlockListener on the shared provider (gated on CHARON_VENUS_ORACLE env var); ChainEvent::NewBlock carries block_hash; the drain path calls PendingCache::drain_for_block with the real confirmed-tx set pulled via eth_getBlockByHash (hashes-only) and runs each UnverifiedPreSigned through Simulator::simulate before verify(SimulationVerdict::Ok). Broadcast stays non-goal per the issue body. Oracle-update channel is logged at debug until the pre-sign builder bridge lands separately.