txBuilder: committee cert redeemers are never resolved to a certificate index

## Summary
`authCommitteeHot` and `resignCommitteeCold` store their redeemer under `cert:{coldCredentialHash}`, but the assembly loop only matches certificates on `stakeCredential` and `drepCredential`. `committeeColdCredential` is never checked, so the lookup always fails, logs a warning, and skips the redeemer.

A Plutus-script committee cold credential therefore produces a transaction with no redeemer for its certificate, which the node rejects. Native-script cold credentials are unaffected, since #494 made those require no redeemer.

## Affected
- packages/evolution/src/sdk/builders/internal/txBuilder.ts:613-631 (loop checks only stakeCredential and drepCredential)
- packages/evolution/src/sdk/builders/internal/txBuilder.ts:632-635 (unresolved index logs a warning and continues)
- packages/evolution/src/sdk/builders/operations/Governance.ts:260, 323 (redeemer keyed by coldCredential)

## Fix
- Add a `committeeColdCredential` branch to the assembly loop.
- Consider failing instead of warning when a cert redeemer cannot be resolved. Building a transaction that is known to be missing a required redeemer is not a useful default.

## Test
Add coverage asserting a Plutus-script `authCommitteeHot` emits a redeemer at the certificate's index.

Start with the assembly loop in packages/evolution/src/sdk/builders/internal/txBuilder.ts:613-635 and compare its credential checks with the redeemer keys created in packages/evolution/src/sdk/builders/operations/Governance.ts:260 and 323. Add coverage for a Plutus-script authCommitteeHot operation and confirm that its redeemer is emitted at the certificate's index rather than being skipped.

Written by the indexing model from the issue text.