Differentiate self_v1 presign and reconstruction requests

[mswilkison]

Summary

• add requestType to covenant signer requests and make it part of normalization and request digests
• reject invalid qc_v1 + presign_self_v1 combinations while preserving explicit self_v1 presign semantics
• refresh mirrored approval-contract vectors and add requestType regressions in covenantsigner and tbtc engine tests

Testing

• go test ./pkg/covenantsigner ./pkg/tbtc -run 'SignerApprovalCertificate|CovenantSigner|ApprovalContractVectors|RequestDigestDistinguishesSelfV1PresignFromReconstruct|RejectsQcV1PresignRequestType' -count=1