Broadcast a multisig wallet's signed activation

raw must be exactly what activation prepared and device_signature D's signature over sha256(raw). Needs X-Passkey-Token from a passkey assertion bound to action tss_sign and the hex sha256 of raw. The vault re-checks the raw, broadcasts it with D's signature alone, and waits a few blocks for the permissions to appear; poll activation/status if it answers pending_activation. A second submit of the same prepared raw is 409. Audited treasury_wallet.multisig_activation_sent then treasury_wallet.multisig_activated.