Co-sign and broadcast a multisig transfer

raw must be a transfer this wallet prepared (and not yet submitted), device_signature D's signature over sha256(raw), and X-Passkey-Token a passkey assertion bound to tss_sign and the hex sha256 of raw. The vault re-checks the raw against what was prepared, adds its own signature last, and broadcasts D + V. The vault's key never signs alone. Audited treasury_wallet.send; fires wallet.transfer.sent.