feat(stacking): move the stacking skill to pox-5

[biwasxyz]

Closes #429. Skills-side counterpart of aibtcdev/aibtc-mcp-server#682 (part of aibtc-mcp-server#677).

Why

pox-5 has been the active PoX contract on mainnet since cycle 141 and removed every function the stacking skill called. #424 made writes refuse; this adds real pox-5 staking.

What

Ported from aibtc-mcp-server#682, which I checked against mainnet before porting: its stake, stake-update and unstake arguments and post-conditions match real successful transactions, and its reward-claim post-conditions match the Xverse signer manager's payout code.

Subcommand	pox-5 call
get-pox-info	get-pox-info + burn height: cycle, next cycle start, prepare phase
get-stacking-status	get-staker-info, get-bond-membership, locked/unlocked balance
list-signers (new)	walks the signer set for a cycle; optional claim style per manager
stack-stx	stake(signer-manager, amount, num-cycles, start-burn-ht, signer-calldata)
extend-stacking	stake-update: extend, increase, switch signer, change payout calldata
unstake-stx (new)	unstake
get-rewards (new)	staker unclaimed + manager unpulled for a cycle
claim-rewards (new)	pulls for the manager if needed, then claim-staker-rewards

stack-stx / extend-stacking flags change: signer manager instead of a PoX BTC address and burn height. Optional --btc-reward-address (+ --max-withdrawal-fee-sats) encodes {pox-addr, max-fee} calldata; --signer-calldata-hex passes raw calldata.

Differences from the MCP version

• Every write first confirms /v2/pox still reports pox-5, and refuses before signing otherwise (fail closed if unreadable), keeping fix(stacking): refuse writes when pox-4 is not the active PoX contract; read pox-5 staking status #424's protection for a future PoX bump.
• StackingService takes an optional { hiro, callContract } for tests, instead of module mocks, which leak across files under bun test.

Also

• pillar-direct: direct-stack-stx --pool fast-pool and direct-revoke-fast-pool refuse while pox-4 is not active (the Pillar wallet contract hardcodes pox-4; the real fix is on Pillar's side). The Stacking DAO path is unchanged.
• @stacks/* → ^7.6.0 (staking / pox post-condition types). The lockfile change is limited to those packages.

Verification

• Mainnet reads: get-pox-info (cycle 143, prepare phase from 968350); list-signers → 26 signers for cycle 144 (same as the MCP PR); get-stacking-status for a real Xverse staker → 500 STX, unlock burn height 1170050, matching Hiro's burnchain_unlock_height; get-rewards → claim style staker-arg.
• src/lib/services/stacking.service.test.ts: the 16 MCP tests ported, plus 2 for the active-contract guard (verified to fail with the guard removed).
• CLI validation paths (amount 0, 97 cycles, both payout options, bad cycle) error before the wallet loads; Fast Pool commands refuse on mainnet before touching keys.
• bun run typecheck, bun run validate; stacking/stacking.ts and pillar/pillar-direct.ts type-checked separately (the repo's typecheck only covers src/).
• Full bun test (Bun 1.4.2): 180 pass / 38 fail vs main 162 / 38. The 38 failures are the existing cross-file mock leak; x402 files pass alone (72/72) on 7.6.0.
• Not exercised live: no transaction was broadcast. A small testnet stake → unstake before relying on it is worthwhile, as with the MCP PR.

🤖 Generated with Claude Code