Align holdings and locking with Amulet's owner-co-signed authority model #29

User story / Problem statement

Currently holdings are signed by the admin alone, which means the admin can mint, move, reissue, or lock any party's funds without that party's consent. Amulet does not work this way: its holdings are co-signed by the owner. As a token holder, I want my signature required before my holdings change, so that the admin cannot act unilaterally on my balance.

Expected outcome

Token is signed by both the admin and the owner, and LockedToken additionally by the holders. Every operation that creates or consumes a holding carries the owner's authority, obtained either from the owner as a controller or from a receiver-signed preapproval.

Acceptance criteria

• Token is signatory admin, owner
• LockedToken is signatory admin, owner, holders
• Mint is controlled by the admin and the recipient jointly
• The direct transfer path obtains receiver authority by exercising a receiver-signed preapproval choice rather than minting into the receiver directly
• Locking and unlocking are controlled by the owner and the holders
• Reject, withdraw, and cancel funnel through one shared escrow-abort routine
• The full Daml suite is green under the new signatory sets

Technical notes

Daml authorization is a runtime property, so changing a signatory set type-checks cleanly and fails only when a script exercises the affected choice. Expect the test suite, not the compiler, to find every site that silently relied on admin-only authority. Design doc: docs/superpowers/specs/2026-07-09-amulet-authority-parity-design.md.

Additional context

Part of #20. Implemented by #6.