op-script-engine: enforce cheatcode access control (parity with Go host's auto-grant-on-deploy)

Follow-up to #21743 (Rust script engine). Deferred out of the landing stack (#21750–#21752) deliberately.

## Gap

The Rust engine does **not** enforce cheatcode access control. The Go host denies cheatcode calls from addresses outside its `allowed` set (`AccessControlledPrecompile`), but it also **transitively auto-grants access to every contract a script deploys** (`script.go` onOpcode auto-grant). Naive enforcement in the Rust engine (deny callers not in `allowed`) provably breaks byte-parity: the routed deploy scripts deploy helper contracts that call cheatcodes and rely on the auto-grant.

On all routed paths this is currently a no-op difference (every caller is legitimately granted), so the landing stack ships with enforcement off, documented in `cheatcodes.rs`. It remains a defense-in-depth divergence from the Go host.

## Work

Implement enforcement together with the transitive auto-grant-on-deploy (address computation under prank/CREATE2-deployer needs care), gated by the existing A/B parity suites: enforcement must land with **zero** parity diffs on the routed scripts, plus a new negative test (unauthorized caller → revert matching the Go host's error).

🤖 *Generated by Claude Code*

Read cheatcodes.rs for the current enforcement-off behavior, then compare the Go host's AccessControlledPrecompile and script.go onOpcode auto-grant path. Use the A/B parity suites as the first validation point; done means zero routed-script parity diffs and a negative test showing an unauthorized caller reverts with the Go host's error.

Written by the indexing model from the issue text.