Cancel a request while it is unpriced

[hpmaxi]

Priority

High — must be addressed in current sprint

User story / Problem statement

A request cannot be withdrawn. Once an investor deposits, the settlement asset sits in the vault
until the epoch is closed and fulfilled, and there is no path back. If an epoch is never fulfilled,
the deposit is stuck.

The design makes a request cancellable until the attestation that prices it is accepted.

Expected outcome

Either side of a request can be cancelled while its epoch is unpriced, and the funds return in the
same call.

Acceptance criteria

• Cancelling a deposit returns the settlement asset and removes the amount from the epoch total.
• Cancelling a redemption returns the escrowed shares and removes them from the epoch total.
• Cancellation is refused once the epoch is fulfilled.
• Cancellation is never blocked by the guardian pause.
• The policy decision from Cancel a request while it is unpriced #74 is implemented for a de-listed or frozen controller, on both sides.
• After cancelling, the same investor can request again in the same epoch.
• The reserve figures reflect the cancellation immediately, so the treasury cannot deploy assets
  that are still refundable.

Technical notes

The last criterion is the one with teeth. Assets backing an unpriced deposit are refundable, so they
are not free reserve. Today free_reserve subtracts only what priced redemptions owe.

Whether a closed-but-unfulfilled epoch is still cancellable is part of this issue's decision: the
epoch is sealed, and no price exists yet.

[hpmaxi]

Note from review of PR #70: fulfill_epoch currently checks TokenClient::balance < pending to ensure redemption coverage. Because TokenClient::balance includes unpriced deposits from the open epoch, fulfilling an older epoch can inadvertently consume assets deposited in the new epoch.

Once unpriced deposits become cancellable, fulfill_epoch's liquidity check must exclude unpriced/cancellable deposits so that older redemptions cannot be fulfilled using refundable funds that may be cancelled.

[hpmaxi]

Design Decision: Cancellation Window and Reserve Accounting

Following architectural review:

1. Window: Cancellation (cancel_deposit / cancel_redeem) is permitted only while the epoch is Open. Once the manager closes the epoch (transition to Pending), requests are sealed and cannot be cancelled.
2. Reserve Invariant (StrongGuard): Unpriced deposits in open epochs are refundable escrow and are NOT free reserve. Once cancellation is implemented, free_reserve calculation must explicitly subtract unpriced open deposits (cancellable_deposit_escrow), preventing the treasury from deploying refundable capital to the custodian:
   $$\text{free_reserve} = \text{balance} - \text{pending_redeem_assets} - \text{open_deposit_escrow}$$
3. Scope: Belongs strictly to Cancel a request while it is unpriced #74 (does not block PR Build the async vault: epochs, claims, treasury and roles #70).