feat: #2241 add a trace-call matcher for reverted and internal-call triggers

[zkasuran]

Closes #2241 (matching seam; see below for what is deliberately out of scope).

What this does

eth_getLogs sees only what a contract chose to emit, so a workflow cannot trigger on a reverted transaction, an internal ETH transfer, a delegatecall into an unlogged implementation, nor an unlogged privileged call. Those are the highest-value security signals and they are invisible today.

The survey in #2247 settled the trace-method access question. lib/web3/trace-decode.ts already flattens a callTracer tree into ordered FlatCall frames with correct top-down revert propagation. What was missing is the match step #2241 names. This adds it:

• matchTraceCalls(root, filter) selects flattened frames by caller, callee, selector, callTypes, minValue, plus a status of success (default), reverted or any.
• callSelector(call) returns a frame's 4-byte selector, using 0x for a value-only frame.

An empty filter matches every executed frame; each field is a wildcard when unset. Addresses and selectors compare case-insensitively.

Scope

In scope: the pure matcher and its helper, next to the existing decoder. Out of scope, kept separately shippable so this can land while the provider-access question the survey flagged is resolved by a maintainer: wiring a Trace trigger type, block polling, plus any Aetherlay change. No new dependency, no network in the matched path, no schema change.

Verified

• tests/unit/trace-match.test.ts: 13 cases covering the default success-only behaviour, a reverted subtree (both frames roll back, matching EVM semantics), value thresholds, delegatecall matching, selector and caller matching, plus case-insensitivity.
• The existing tests/unit/trace-decode.test.ts is unchanged and still passes (31 tests across the two files).
• tsgo --noEmit and biome check clean on both files.

AI disclosure

AI assistance (Claude, Anthropic) was used in developing this change. The design and verification are the author's. Verified locally before submitting: the two test files above, plus tsgo and biome on the changed files.

[github-actions]

About the build check on this pull request

This pull request comes from a fork, so GitHub does not pass it the credentials build normally uses for our image registry cache and staging build configuration. The build still runs and still compiles the image, so a red build here is real; it just takes longer than on team branches.

Every workflow run on a pull request from a fork also waits for a maintainer to approve it, so checks can sit at "awaiting approval" for a while after each push. Nothing is needed from you for either of these.