broker: split broker/tests.rs into schema / validation / client modules

Follow-up from review of #6742 (broker action contract, PR 1 of the broker stack). Quality review approved the PR at `5e2879a72` and flagged one non-blocking item: `crates/buzz-sdk/src/broker/tests.rs` is now **1,693 lines**, past the point where its section headers compensate for file size.

**This is a mechanical split, not a test change.** It must land *before* the next broker test addition — i.e. before PR 2 of the stack (broker client + `buzz agents` CLI) grows the file further. Do not do it on `ss-dev-00/broker-action-contract`; that head is frozen for review.

## What to do

Split `broker/tests.rs` into focused child modules along the existing section boundaries, moving code **verbatim**. Current sections and their sizes at `5e2879a72`:

| Lines | Section | Goes to |
|---|---|---|
| 1–163 | fixtures + helpers (`pubkey`, `signed_message`, `all_error_codes`, `action_fixtures`, `outcome_fixtures`, `prepared`, `keys_of`, the three consts) | `tests/mod.rs` (shared) |
| 164–195 | Coverage | `tests/schema.rs` |
| 196–463 | Envelope round-trip | `tests/schema.rs` |
| 464–565 | Envelope rejection | `tests/schema.rs` |
| 566–881 | Wire schemas: the enforceable no-secret invariant | `tests/schema.rs` |
| 882–986 | Argument validation | `tests/validation.rs` |
| 987–1189 | Reads carry verifiable provenance | `tests/validation.rs` |
| 1190–1385 | Results | `tests/validation.rs` |
| 1386–1455 | Retry is identical bytes | `tests/client.rs` |
| 1456–1693 | Client trait (`DoubleBroker`, `WireBroker`, `block_on`) | `tests/client.rs` |

Resulting sizes: schema ≈ 718, validation ≈ 504, client ≈ 308, plus a shared `mod.rs` of ≈ 163 — all comfortably under the repo's 1,000-line cap.

## Constraints

- **Keep it in-crate.** `tests.rs` is a `#[cfg(test)] mod tests;` child of `broker` (`crates/buzz-sdk/src/broker/mod.rs:838`) and starts with `use super::*`. The strictness guards it exercises live in `Deserialize` impls behind private wire intermediaries — `WireResponse` (`broker/mod.rs:623`) and `StrictEvent` (`broker/actions/outcomes.rs:30`) — and `Dispatch`'s field is private to the client module. Converting these to `crates/buzz-sdk/tests/` integration tests would change what they can reach and what they prove. Structure the split as `broker/tests/{mod,schema,validation,client}.rs`.
- **Tables preserved unchanged.** The exact-key-set schema table, `all_error_codes()`, the status↔error-code table (which deliberately spells the table a *second* time rather than consulting `may_be_failed()`/`may_be_indeterminate()`), and the read-limit boundary table are the load-bearing part of this suite. Copy them; do not rewrite, dedupe, parameterize, or "tidy" them.
- **No behavioral coverage added in the same change.** Review explicitly did not ask for more tests here. A split that also adds or edits assertions cannot be reviewed as a no-op.
- **Guard against silent loss:** the test count must be identical before and after (`cargo test -p buzz-sdk` reports 289 at `5e2879a72`). `fixtures_cover_every_action` stays as the guard that a new action cannot go untested, so it belongs wherever the fixtures do or must remain reachable from there.

## Verification

`cargo test -p buzz-sdk` (same pass count, no scoped module run), `cargo clippy --workspace --all-targets -- -D warnings`, `cargo fmt --check`, and the repo file-size check.

Context: PR #6742 · parent issue #6467.