feat(escrow): drop escrow_wip feature gate, ship as default surface

Per Sulkta 2026-05-09 directive: after the audit + preprod E2E green-light
(6/6 builders, 9 successful txs, 0 failures), drop the compile-time gate
and integrate escrow as a default-on feature. The "not third-party
audited" framing becomes a runtime notice carried by escrow_open_unsigned
rather than a Cargo feature.

Changes:
- aldabra-dao/Cargo.toml: drop [features] block + escrow_wip = []
- aldabra-dao/src/agora/mod.rs: pub mod escrow (no cfg gate)
- aldabra-dao/src/builder/mod.rs: 6 escrow_* modules unconditional
- aldabra-mcp/Cargo.toml: drop features = ["escrow_wip"] from dao dep
- aldabra-mcp/src/tools.rs:
  - Drop "WIP — UNAUDITED:" prefix from all 6 escrow tool descriptions
  - Drop "wip_warning" JSON field from all 6 spend-tool responses
  - Add "audit_notice" field on escrow_open_unsigned response only
    (per Sulkta's framing — once-per-escrow-conversation, not repeated
    on every subsequent tool)
  - Update section header comment to reflect post-WIP status
- 7 escrow source files (1 agora + 6 builder): replace
  "WIP / UNAUDITED. Feature-gated behind escrow_wip" docstring with
  "Not third-party audited — preprod-only" + audit doc reference

Verified: 133 dao tests pass (was 132 under --features escrow_wip;
+1 from the rejects_no_initial_contributor test that's now always
compiled). aldabra-mcp release build clean.

The runtime audit_notice on escrow_open_unsigned reads:
  "This escrow validator has had an internal review and a 9-tx preprod
   E2E pass, but has NOT been audited by an external third party. Use
   at your own risk. If the user is opening this with anything beyond
   test-net or low-value funds, pass this notice along and confirm they
   accept the risk. Validator hash: a8081acef26935d9b5f44b92052178e17301b6d6e6808c91c5b56f5d."

This carries the same caveat the WIP framing did, but in a form the
calling agent can surface inline to the user opening the escrow.

crates/aldabra-dao/Cargo.toml

@@ -71,13 +71,6 @@ thiserror = { workspace = true }
 # Logging.
 tracing = { workspace = true }
 
-[features]
-default = []
-# WIP / unaudited two-party escrow validator + builders + types. Compiled
-# out of default builds until external audit lands. Enable with
-# --features escrow_wip from the workspace root.
-escrow_wip = []
-
 [dev-dependencies]
 # DaoStore tests use a temp dir as the data root.
 tempfile = "3"

crates/aldabra-dao/src/agora/escrow.rs

@@ -1,6 +1,6 @@
 //! Escrow datum + redeemer encoding.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`. Preprod-only.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! Mirrors the on-chain validator at `aiken-escrow/escrow/validators/escrow.ak`.
 //! See `aiken-escrow/README.md` for the full state machine.

crates/aldabra-dao/src/agora/mod.rs

@@ -40,12 +40,10 @@ pub mod stake;
 pub mod treasury;
 
 pub mod authority_token;
+pub mod escrow;
 pub mod plutus_data;
 pub mod reference_scripts;
 
-#[cfg(feature = "escrow_wip")]
-pub mod escrow;
-
 pub use governor::{GovernorDatum, GovernorRedeemer};
 pub use proposal::{
     ProposalDatum, ProposalRedeemer, ProposalStatus, ProposalThresholds, ProposalTimingConfig,

crates/aldabra-dao/src/builder/escrow_agree.rs

@@ -1,6 +1,6 @@
 //! Build an unsigned `escrow_agree_unsigned` transaction.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! ## What this tx does
 //!

crates/aldabra-dao/src/builder/escrow_deposit.rs

@@ -1,6 +1,6 @@
 //! Build an unsigned `escrow_deposit_unsigned` transaction.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! ## What this tx does
 //!

crates/aldabra-dao/src/builder/escrow_open.rs

@@ -1,6 +1,6 @@
 //! Build an unsigned `escrow_open_unsigned` transaction.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! ## What this tx does
 //!

crates/aldabra-dao/src/builder/escrow_refund_timeout.rs

@@ -1,6 +1,6 @@
 //! Build an unsigned `escrow_refund_timeout_unsigned` transaction.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! ## What this tx does
 //!

crates/aldabra-dao/src/builder/escrow_settle.rs

@@ -1,6 +1,6 @@
 //! Build an unsigned `escrow_settle_unsigned` transaction.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! ## What this tx does
 //!

crates/aldabra-dao/src/builder/escrow_veto.rs

@@ -1,6 +1,6 @@
 //! Build an unsigned `escrow_veto_unsigned` transaction.
 //!
-//! ⚠️  WIP / UNAUDITED. Feature-gated behind `escrow_wip`.
+//! ⚠️  Not third-party audited — preprod-only. See `aiken-escrow/README.md`.
 //!
 //! ## What this tx does
 //!

crates/aldabra-dao/src/builder/mod.rs

@@ -17,22 +17,15 @@
 //! | def.  | `stake_create`        | Lock TRP at stakes script (deferred — both |
 //! |       |                       | live wallets already have stakes) |
 
+pub mod escrow_agree;
+pub mod escrow_deposit;
+pub mod escrow_open;
+pub mod escrow_refund_timeout;
+pub mod escrow_settle;
+pub mod escrow_veto;
 pub mod proposal_advance;
 pub mod proposal_cosign;
 pub mod proposal_create;
 pub mod proposal_retract_votes;
 pub mod proposal_vote;
 pub mod stake_destroy;
-
-#[cfg(feature = "escrow_wip")]
-pub mod escrow_agree;
-#[cfg(feature = "escrow_wip")]
-pub mod escrow_deposit;
-#[cfg(feature = "escrow_wip")]
-pub mod escrow_open;
-#[cfg(feature = "escrow_wip")]
-pub mod escrow_refund_timeout;
-#[cfg(feature = "escrow_wip")]
-pub mod escrow_settle;
-#[cfg(feature = "escrow_wip")]
-pub mod escrow_veto;