feat(PT9-502): add chained postInteraction (tail) encode/decode

[rharutyunyan]

What

Adds Extra.chainedPostInteraction (string | string[]) to Fusion orders: the raw bytes are encoded after SurplusParams in the FeeTaker-style settlement postInteraction payload and decoded back on the way in.

This matches FeeTaker.sol's on-chain semantics: after flags, fee recipients, optional custom receiver, fee/whitelist data and surplus params are consumed, a remaining tail of >= 20 bytes is called as IPostInteraction(address(bytes20(tail))) with tail[20:] as extraData. Needed for Ether.fi postInteraction chaining in Fusion swaps (same pattern as the earlier OKX integration).

Details

• Encode: string[] chunks are concatenated in order into a single tail; every chunk is validated as 0x-prefixed even-length hex before joining (odd-length chunks throw instead of silently merging into corrupted tail data). An empty concatenation ([]) means no tail.
• Decode: target-only 20-byte tails are supported (FeeTaker calls the target for any tail of at least 20 bytes); non-hex or <20-byte decode leftovers throw invalid interaction instead of silently producing a broken round-trip. The target-only stand-in lives in src/fusion-order/target-only-interaction.ts (the Interaction constructor rejects empty data, so a dedicated class is needed).
• Based on the reference implementation belactriple9/fusion-sdk@0f925cd (Caleb Rippey), with one intentional narrowing: makerPermit / preInteraction decoding keeps strict Interaction.decode — the lenient target-only path applies only to the chained tail (a target-only permit is invalid on-chain and upstream never accepted a 20-byte preInteraction).

CI fixes (separate commits)

• Audit: the pr-check Security step (pnpm audit --audit-level high) fails on main's unchanged lockfile with 11 high advisories published after the last green run (Jul 7) — any PR against main hits this today. Remediated via the existing pnpm.overrides convention (axios >=1.18.0, brace-expansion per-major patched releases, js-yaml 3.15.0/4.3.0, fast-uri >=3.1.4). GHSA-mh99-v99m-4gvg (brace-expansion OOM, "patched" only in 5.0.8) is ignored via pnpm.auditConfig.ignoreGhsas because forcing 5.x onto the minimatch 3.x/9.x CJS consumers breaks eslint (expand is not a function); exposure is dev-tooling-only glob expansion of repo-controlled patterns. Remaining low/moderate advisories don't gate --audit-level high and are left untouched.
• Publish workflow: publish.yml pinned version: 10 on pnpm/action-setup@v4, which conflicts with the packageManager: pnpm@10.26.2 field added to package.json on main in 1591f35 (after the last 2.4.x publish) — the action hard-errors with "Multiple versions of pnpm specified", so both publish jobs failed at the Install pnpm step for v2.4.11-rc.0 (run 30270683953). Dropped the input so packageManager is the single source of truth, matching pr-check.yml. Note: tags cut before this fix (e.g. the existing v2.4.11-rc.0) still carry the broken workflow and must be re-cut from a head that includes it.

Verification

• pnpm lint:ci — 0 errors (19 pre-existing warnings in ws-api/connector)
• pnpm lint:types — clean
• pnpm test — 17 suites / 104 tests passed
• pnpm build — esm + cjs + types clean
• pnpm audit --audit-level high — exit 0

Downstream

1inch/gasless-swap.1inch.io#1684 activates its chained-postInteraction target allowlist once the @1inch/fusion-sdk-v2.2-surplus alias in gasless is bumped to a release that includes this change (until then, tailed orders are safely rejected at parse).

Reference

Jira: PT9-502