Check that SEP-24 /info lists the asset the TOML claims

Written to the standard set by #33 — read that issue first for the expected level of detail and the acceptance criteria every check shares. ## What Check that an anchor's declared SEP-24 `/info` endpoint lists the asset its `stellar.toml` claims to support. ## Why it matters An anchor can declare a currency in its TOML and offer no actual deposit or withdrawal path for it. The TOML is a claim; `/info` is the operational answer. Where they disagree, the asset is listed but not served — which a user discovers only after committing to a transfer. This is the same declared-versus-actual gap `sep10.endpoint-responds` covers for authentication. ## Which layer **Layer 1 — observable fact.** ## Exactly where the code goes - **New file:** `checks/sep24_info_lists_asset.go` - Tests appended to `checks/checks_test.go` - Register in `Runner.Default()` in `checks/runner.go` - Model it on `checks/sep10_endpoint.go` — same shape: read a declared endpoint, probe it, compare ## Where the data comes from `TRANSFER_SERVER_SEP0024` from the TOML (already parsed into `anchor.TOML`), then `GET {server}/info`. SEP-24: https://github.com/stellar/stellar-protocol/blob/master/ecosystem/sep-0024.md ## What "unmeasurable" means here - No `TRANSFER_SERVER_SEP0024` declared → UNABLE-TO-DETERMINE. The anchor offers no SEP-24; that is a position, not a fault - Endpoint unreachable or non-200 → **determined failure**. The anchor published this address (see the "whose failure is it" section of docs/checks.md) - `/info` responds but omits the asset → **determined failure**: declared in one place, absent in the other ## Acceptance criteria - [ ] Implements the Check contract in docs/checks.md - [ ] Returns UNABLE-TO-DETERMINE when SEP-24 is simply not offered - [ ] Records evidence: the endpoint probed and what it listed - [ ] Uses `Runner.client()` so it inherits the SSRF guard — this probes an anchor-published URL - [ ] Table tests from recorded bytes; no live network - [ ] Negative test: `/info` responding without the asset - [ ] Distinguishes deposit-enabled from withdraw-enabled rather than collapsing them - [ ] No new third-party dependencies - [ ] gofmt, vet, test -race, golangci-lint clean - [ ] Does not change the headline integrity state or verdict thresholds ## Out of scope Do not attempt a deposit or withdrawal. This is read-only, like everything else here. Nothing in `route/`, `dex/`, `sep38/`, `runstore/runstore.go`. ## How to verify locally ```bash make offline-test go test ./checks/ -run TestSEP24 -v ```