Cardano Updates

Replaces the unused `_version: Int` validator parameter with
`seed: OutputReference`. Each cage instance is now a unique script
hash → one address → one minted token. CSMT subtree completeness at
the cage address proves "all pending requests for this exact token,"
with no cross-token bandwidth coupling.

Validator changes:
- mpfCage parameter: `seed: OutputReference` (was `_version: Int`).
- `MintRedeemer.Minting` collapsed to unit; `Mint { asset }` removed.
- `validateMint` derives `tokenId = assetName(seed)` from the param;
  enforces seed UTxO consumption.
- `validateMigration` pins `tokenId.assetName == assetName(seed)`
  so migrations cannot relabel the token across the boundary.
- `UpdateRedeemer.Sweep(OutputReference)` added — owner reclaims
  non-legitimate UTxOs at the cage. Direct O(1) state lookup via the
  redeemer's pointer (in inputs or reference_inputs); confirms the
  pointed-to UTxO carries cageToken before reading the state datum.
- Spend Modify/End paths add defense-in-depth
  `expect extractedToken == cageToken`.
- `validModify` short-circuits the per-request refund-conservation
  equation when `n == 0` (zero-request tick: root unchanged, no
  refunds, oracle pays tx_fee from sweep dust).

Tests cover Sweep happy paths (no-datum garbage, wrong-token request,
fake-state-no-NFT, alongside Modify), Sweep negative paths (non-owner,
fake-state-ref, legitimate state, legitimate request), zero-request
Modify (positive + negative root mutation), and per-token isolation
across two distinct seeds. 1286 checks, 0 errors.

Implements: specs/003-per-token-cage-with-sweep/spec.md FR-001..FR-011.
Closes: cardano-foundation/cardano-mpfs-onchain#47

Speckit artifacts for #47, superseding #24's per-oracle approach.
Captures per-token parameterization (seed: OutputReference), Sweep
redeemer with direct state UTxO lookup, zero-request Modify support,
defense-in-depth token-equality checks, and migration asset-name pin.