Add CTS-controlled pending application

[ap0calypse644]

What changed

• adds ControlledConfidentialTransferClient, preserving automatic applyPending by default but allowing orchestrators to disable it with autoApplyPending: false
• exposes a public applyPending() method without changing the existing ConfidentialTransferClient API
• exports the controlled client from the package root
• updates normal confidential event ABIs to match the current Fairyring Diamond (ResultCode as uint8, current field ordering, current offchain flag placement)
• adds regression tests for default auto-apply behavior, disabled auto-apply behavior, and public applyPending() forwarding

Why

CTS must own pending-state scheduling explicitly. Hidden auto-apply inside deposit/transfer/withdraw would make applyPending traffic impossible to schedule, persist, quarantine, and reconcile independently.

The existing SDK behavior remains backwards compatible because auto-apply stays enabled unless a caller explicitly disables it.