[ecash-agora, Cashtab] Refuse ONESHOT offers that redirect NFTs from buyers

Summary:
This is in response to a detailed bug report.

ONESHOT covenants accept arbitrary enforcedOutputs. A malicious maker can serialize an extra maker-controlled output so SLP SEND [0, 1] colors the NFT onto that output while AgoraOffer.take() still appends the buyer dust output after it and pays the full ask. Buyers using the standard take() path (including Cashtab) receive no token.

Validate the safe marketplace shape (OP_RETURN SLP SEND [0, atoms] plus exactly one maker payment) in list/accept/take and when parsing offers; have Cashtab assert the same shape before take and price ONESHOT listings via askedSats().

Test Plan:

• cd modules/ecash-agora && pnpm test
• BUILD_DIR=<bitcoin-abc/build> run oneshot-nft-redirection.test.ts
• Cashtab NFT buy/list still works; unsafe ONESHOT offers are not surfaced by offer parsing and take() throws

Reviewers: #bitcoin_abc, Fabien, tobias_ruck

Reviewed By: #bitcoin_abc, Fabien, tobias_ruck

Differential Revision: https://reviews.bitcoinabc.org/D20321