feat(agglayer): add faucet deregistration

[partylikeits1983]

Closes #2705.

Adds a bridge-admin-gated deregister_faucet MASM procedure that clears a faucet from both the faucet_registry_map and token_registry_map, asserting the faucet is currently registered before clearing. Wired through a new DEREGISTER_AGG_BRIDGE note script and DeregisterAggBridgeNote Rust builder.

After a faucet is deregistered, any in-flight B2AGG notes hit ERR_FAUCET_NOT_REGISTERED in bridge_out's assert_faucet_registered, and any in-flight CLAIM notes hit ERR_TOKEN_NOT_REGISTERED in lookup_faucet_by_token_address. The bridge admin should drain or warn users about pending notes before deregistering.

Changes

• bridge_config.masm: new pub proc deregister_faucet that calls assert_sender_is_bridge_admin, then assert_faucet_registered (so a typoed faucet ID panics rather than silently no-ops), then writes [0,0,0,0] to faucet_registry_map (key [0,0,suffix,prefix]) and to token_registry_map (key Poseidon2::hash_elements(origin_token_addr[5])). Reuses the existing assert_sender_is_bridge_admin, assert_faucet_registered, and hash_token_address helpers — no new helpers added.
• components/bridge.masm: re-export deregister_faucet.
• asm/note_scripts/DEREGISTER_AGG_BRIDGE.masm: new note script mirroring CONFIG_AGG_BRIDGE's 7-felt storage layout (origin_token_addr[5], faucet_id_suffix, faucet_id_prefix).
• src/deregister_note.rs: new DeregisterAggBridgeNote::{script, script_root, create} builder, mirroring ConfigAggBridgeNote.
• SPEC.md: new §3.1 entry for bridge_config::deregister_faucet, new §4.4 entry for the DEREGISTER_AGG_BRIDGE note (subsequent §4.x renumbered + cross-refs updated), §7.1 mentions deregistration as the inverse op with the in-flight-note caveat.
• CHANGELOG.md: new Unreleased Features entry.

Tests

Three new tests in crates/miden-testing/tests/agglayer/config_bridge.rs:

• test_deregister_agg_bridge_clears_both_registries — register, then deregister; asserts faucet_registry_map[key] == [0;4] and token_registry_map[hash] == [0;4].
• test_deregister_agg_bridge_fails_when_not_registered — submit DEREGISTER_AGG_BRIDGE with no prior register; expects ERR_FAUCET_NOT_REGISTERED.
• test_deregister_agg_bridge_fails_when_sender_not_admin — register first (so the panic comes from the auth check, not the registration check), then submit deregister from a non-admin wallet; expects ERR_SENDER_NOT_BRIDGE_ADMIN.