feat(wallet_screening): refresh OFAC SDN snapshot (#287)

[Hendobox]

Summary

• Projects the 13 Oct 2026 OFAC SDN.CSV publication into finance/wallet_screening (v1.0.2). Ethereum screening indexes currency code ETH only (87 addresses), including both Shelbit wallets. Non-ETH identifiers, including 0x USDT/USDC, are stored but not used as Ethereum match keys.
• Ships normalized_ofac_sdn.json, ofac_sdn_manifest.json (sha256 a472434fd73854d52b8c0e53d4348f50a73c2cd5651cb2db1d6b8917e6b7f405), and ofac_sdn_quarantine.json. One truncated XBT remark (Matthew Simon Grimm) is quarantined instead of published. Re-run maintenance/normalize_ofac_sdn.py for the next full-file replacement. Absence from a snapshot is not a delisting.
• Aban Tether remains an entity-only designation with no digital-currency identifier in SDN remarks, so address screening cannot hit it.
• [RFC]: Harden wallet_screening data pipeline, parsing, coverage, and report schema v2 #115 data cleanup included here: dropped Helix and Hydra rows that reused the Sinbad and ChipMixer addresses, and stripped 978 zero-width characters from Israel NBCTF addresses. The stale "880+" list count is corrected.

Fixes #287
Refs #115

This does not close #115. Still open there: live Chainalysis/TRM, schema v2 / risk_level, and tokentx / txlistinternal.

Deferred peer lists

• OpenSanctions il_mod_crypto, FBI Lazarus, Israel NBCTF, and Uniswap TRM stay on the 22 Jul 2025 snapshots. No newer public drop was in the bundle to ingest.
• UK OFSI (May 2026 HTX/A7), the EU 20th package, and the MEW darklist had no concrete address file to normalize.

Test plan

• pytest skills/finance/wallet_screening/test_ofac_sdn.py covers duplicate ETH observations, non-ETH 0x, snapshot omission, quarantine vs empty wallet set, and malformed CSV rejection
• Bundled Shelbit lookup via _lookup_sanctions_hits (mixed-case input)
• tests/skills/finance/test_wallet_screening.py and tests/test_registry_docs.py
• Reviewer: confirm the manifest sha256 against a fresh SDN.CSV download before merge if the publication moves

[rosspeili]

LGTM @Hendobox ! Excellent, disciplined and very clean PR! Merging as is.