solana-cli: add a Squads vault path to shreds validator-client-rewards claim

CHANGELOG.md

@@ -15,6 +15,7 @@ All notable changes to this project will be documented in this file.
 ### Changes
 
 - CLI
+  - `doublezero-solana shreds validator-client-rewards claim` takes `--multisig`, so a manager held by a Squads vault can claim. The vault stands in for the wallet, no keypair is loaded, and the command prints numbered base58 payloads for import into Squads instead of sending, creating the vault's associated token account in every payload when it is missing. `--max-transactions` caps how many transactions one invocation produces, and the fixed 16-holding cap gives way to measured packing. (malbeclabs/doublezero#4185)
   - `doublezero-solana shreds payments` asks the Solana node for version 1 and reads the JsonParsed instruction list, so a v1 fund no longer fails the listing with error -32015.
 - CI
   - The testnet release pushes its component tags with a token minted from the release bot app instead of `DOUBLEZERO_PAT`. That personal token was set on 2025-09-10, a fine-grained token lives at most 366 days, and its expiry stopped the v0.40.0 release at the checkout step inside the tag job. The app credentials carry no PAT-style calendar expiry, so there is nothing left to rotate each year; each run mints its own installation token, which lives about an hour and is scoped to `contents: write`. Unlike `GITHUB_TOKEN`, a tag pushed with an app token still starts the package builds the release waits for. `DOUBLEZERO_PAT` can be deleted from the repository secrets once this is on main.

offchain/crates/solana-cli/CHANGELOG.md

@@ -7,6 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+- `shreds validator-client-rewards claim`: add `--multisig` and `--vault-index`, so a manager held by a Squads vault can claim. The vault stands in for the wallet as manager, no keypair is loaded, and the command prints numbered base58 payloads for import into Squads instead of sending, with the holdings, epochs and pre-claim total each payload covers, a closing recap, and the destination token account's authority. The default destination becomes the vault's associated token account, and every payload creates it when it is missing, with the vault paying the rent. Add `--max-transactions N` to cap how many transactions one invocation produces, reporting how many were withheld. Retire the fixed 16-holding cap: each transaction grows one holding at a time while a trial still fits, which takes 19 holdings per direct transaction, 16 with a distinct `--fee-payer`, and 11 per vault payload into an existing destination. A vault payload is packed against the Squads packing budget, which leaves room for a memo typed at import, and carries neither a version check nor a compute budget, since it executes days after it is written and Squads sets the budget on its own execute transaction. Each payload reports the compute units it needs. On the vault path an existing `--destination-token-account` has to be the vault's own, since approvers see only the base58 ([malbeclabs/doublezero#4185](https://github.com/malbeclabs/doublezero/issues/4185))
 - `shreds payments`: ask the Solana node for version 1 and read JsonParsed instruction lists, so a v1 fund no longer fails the listing with error -32015
 - Remove `revenue-distribution convert-2z` and `harvest-2z` (malbeclabs/doublezero#4275)
 - Validator deposit no longer accepts `--convert-2z-limit-price`