Composite weight

composite-weight v1: combine weight sources

A weight plugin for `staking-vault` that combines up to four other plugins:

| mode | result | |---|---| | 0 MAX | the best single reading ("diamond hands **or** questers") | | 1 SUM_BONUSES | 1.00x + every source's bonus over 1.00x | | 2 PRODUCT | the readings multiplied together |

Each source reading is clamped to [1.00x, 5.00x]. The combined result is clamped to [1.00x, `clampBps`], and the vault's own ceiling still applies.

- Each source is read with its own 32k gas budget (4 × 32k fits inside the vault's 150k plugin budget). A source that reverts, returns garbage or runs out of gas counts as 1.00x. `multiplierBpsOf` never reverts. - `_onInit` stores source addresses only and never calls them. In a recipe they may be predicted siblings. - `refresh(vault, ids)` forwards to a vault's permissionless `syncMany`.

**Roles:** the owner can only pause `refresh` and hand over ownership. **Locked:** `sources`, `mode`, `clampBps`. **Value flows / fee lanes:** none.

What if…

- **…one source breaks?** It counts as 1.00x and the others still count. - **…two sources both give a bonus?** MAX takes the best, SUM_BONUSES adds them, PRODUCT multiplies them. All are capped. - **…my multiplier went up but my share did not?** The vault adopts it on sync. Refresh, and it applies from then on.