refactor(lee): unify program dispatch/bijection addresses, fix downstream bugs

Programs dispatch at the address seeded via with_programs/a live Deploy
(loader_core::immutable_deploy_account_id), not the bijection
AccountId::from(program_id) used by the legacy ProgramDeploymentTransaction
storage shape. This sweep threads the correct address through
lee/lez/integration_tests/wallet-ffi call sites and fixes 7 dispatch-address
bugs the mismatch was masking: bijection-vs-real-PDA mismatches in
lez/wallet's native_token_transfer facade, integration_tests'
auth_transfer/private and private_pda suites, wallet-ffi's
generic_transaction FFI boundary, a stale assertion in program_deployment.rs,
and a stale expected-error string in cross_zone_state_machine.rs.

Also includes a full clippy/fmt pass: doc-comment reflow, #[expect(...)]
attribute additions, redundant type-annotation/unused-import removal, and
two assert!s added purely for bounds-check elision on already-guarded
slices — no logic changes. Both CI clippy invocations and cargo fmt --check
are clean.

Verified: RISC0_DEV_MODE=1 cargo test -p lee --lib (214 passed) and the
broader sanity set across lee/wallet/bridge_lock_core/ping_core/
cross_zone_outbox_core/sequencer_core (mock features) both green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lez/programs/program_loader/core/src/lib.rs

@@ -114,6 +114,17 @@ pub fn deploy_segment_account_id(
     )
 }
 
+/// The dispatch address a program with `image_id` lives at once deployed via `Deploy` with no
+/// upgrade authority.
+///
+/// `segment_number` 0, `update_auth` `AccountId::default()`. What every genesis-seeded builtin,
+/// and any `Deploy` submitted with a default `update_auth`, dispatches at.
+#[must_use]
+pub fn immutable_deploy_account_id(image_id: ProgramId) -> AccountId {
+    let loader_id = ProgramId::from(lee_core::program::RESERVED_DEPLOYMENT_PROGRAM_ACCOUNT_ID);
+    deploy_header_account_id(loader_id, image_id, 0, AccountId::default())
+}
+
 /// Executes the `Deploy` instruction: verifies `bytecode` decodes as a valid RISC0 program
 /// binary, derives its header and segment PDAs, and claims both. Called natively from
 /// dispatch's `RESERVED_DEPLOYMENT_PROGRAM_ACCOUNT_ID` shortcut (see that constant's doc