xrpl-muse-skill: let your Muse trade XRP

# xrpl-muse-skill v0.5

Trade the XRP Ledger from the terminal — any token pair — with a hard safety
boundary between **proposing** a trade and **signing** it. v0.5 adds NFT
minting and XRP-denominated listings under the same propose → approve →
sign boundary.

Built for AI agents (Muse, Grok, OpenClaw-style bots — anything with a
terminal). **Testnet-safe by default; mainnet requires the Muse vault
signer or an external protected signer with real per-transaction human
approval.** A same-user local install is testnet-only — see
`SECURITY.md` "Deployment profiles" before mainnet.

## The idea

Most trading tools ask the agent to "ask the human first" and hope it does.
This skill splits the job in two:

- **`xrpl-trade`** builds the transaction, autofills it against the live
  network, shows you *everything* (account, network, assets + issuers,
  amounts, limit price, max spend, fee, expiry), seals it in a **hash-bound
  proposal envelope**, and stops. It never sees your seed. It cannot submit.
- **`xrpl-sign`** is the only program that touches the seed (from the
  `XRPL_SEED` env var — never from a config file). It re-verifies the
  envelope, derives the summary from the transaction itself (nothing stored
  is trusted), enforces the policy file, and signs **only** with explicit
  human `--approve` of that exact hash.

```bash
xrpl-trade buy --pair ARMY/XRP --amount 1000 --price 0.005
# → full proposal + hash. Nothing submitted.

xrpl-sign --hash a2c72140d080ca0f --approve
# → envelope verify → policy checks → sign → persist → validated result
```

## What v0.5 adds

- **NFT minting** (`xrpl-trade nft-stage`, then `nft-pin-and-propose`):
  a deliberate two-step flow. `nft-stage` validates the artwork locally
  (approved media directory, size and image-type checks, SHA-256) and
  writes a reviewable stage record with **zero network calls**.
  `nft-pin-and-propose` is the approved action: it re-validates the file
  against the staged hash, pins artwork + XLS-24d metadata to IPFS
  through the operator's **own** Pinata account, then proposes an
  `NFTokenMint` whose `URI` points at the metadata CID. Pinning is an
  external write and happens *inside* the approved action — never before
  it. `PINATA_JWT` is injected for the single operation (never exported
  into a shell, never stored); the publisher hosts no one's media.
- **XRP listings** (`xrpl-trade nft-list`)