Move scheduled-commit pre-signing out of Magic Program

@snawaz is already working on this.

Since Sep 1, 2026.

## Outcome

Remove the scheduling code that requires Magic Program to access a global validator keypair, unblocking #1535.

## Scope

`ScheduleCommit` and `ScheduleIntentBundle` currently call `InstructionUtils::scheduled_commit_sent`, which reads `validator_authority()` and signs `ScheduledCommitSent` during builtin execution.

Move pre-signing to an Engine-owned boundary and provide scheduling only the resulting transaction or signature. Keep one authoritative flow for both scheduling entrypoints.

Preserve these contracts:

- Magic Program uses `nucleus::tls::AUTHORITY` only for validator pubkey checks.
- Fresh intents log the exact future `ScheduledCommitSent` signature, and the committor executes that same transaction.
- Failed scheduling transactions do not produce notifications.
- Recovered intents are rebuilt against the latest Engine blockhash.
- Validator authorization is not weakened, and the keypair is neither exposed nor duplicated.

This issue blocks #1535. Removing the global static itself remains in #1535.

## Acceptance criteria

- [ ] Magic Program scheduling does not read a `Keypair` or sign `ScheduledCommitSent` transactions.
- [ ] `InstructionUtils::scheduled_commit_sent` and its dependency on `validator_authority()` are removed.
- [ ] Engine is the only owner and signer of validator-owned transactions.
- [ ] Both scheduling entrypoints log the exact signature of the transaction later executed by the committor.
- [ ] Failed scheduling emits no notification, while recovered intents use the latest Engine blockhash.