Bump Codama renderers and regenerate clients

[lorisleiva]

This PR bumps @codama/renderers-js to 2.5.0 and @codama/renderers-rust to 3.1.3, regenerating both clients. The JS client adopts the wider instruction-account input types the new renderer emits, so signer and non-signer accounts now accept any address carrier, account meta, or program-derived address in addition to the previous inputs, while remaining backwards compatible with existing call sites. The @solana/kit floor moves to ^8.3.0 and @solana-program/system to ^0.15.0 to require the newly published System client. The Rust client picks up the corrected CPI remaining-accounts meta, whose is_signer/is_writable fields were previously mapped in the wrong order.

The hand-written plan builders (getExtendInstructionPlan, getWriteInstructionPlan, getCreateBufferInstructionPlan) are widened to accept the same inputs as the generated builders. Where a concrete address is needed to pack instructions across transactions, the account is resolved with getAddressFromResolvedInstructionAccount, matching the generated code. Regression tests exercise the single-extend packing path with a program-derived address and an address carrier.

[lorisleiva]

@trevor-cortex

[trevor-cortex]

Summary

Bumps @codama/renderers-js → 2.5.0 and @codama/renderers-rust → 3.1.3 and regenerates both clients. On the JS side, every generated instruction builder now takes InstructionAccountInput / InstructionSignerInput (Address, HasAddress carrier, PDA tuple, or explicit account-meta override) instead of bare Address / TransactionSigner, with ResolvedInstructionAccountMeta<…> return types mirroring the runtime resolution. The three hand-written plan builders are widened to match, and the one place that needs a concrete Address (the single-extend packer's growth accounting) resolves it via getAddressFromResolvedInstructionAccount. On the Rust side, the CPI remaining_accounts tuple is now mapped as (AccountInfo, is_writable, is_signer), which matches the add_remaining_account signature and docstring — the old code had the two bools swapped. Peer floor moves to @solana/kit ^8.3.0 (first release with the widened input types) and @solana-program/system ^0.15.0.

Everything checks out — the generated files are consistent across all nine instructions, the hand-written widening is minimal and correct, and the new tests cover exactly the path where a non-Address input would have silently broken the packing.

Things I verified

• createBuffer.ts still reads input.authority.address after widening to InstructionSignerInput. That's fine: the union is TransactionSigner | AccountSignerMeta, and both members expose address.
• getAddressFromResolvedInstructionAccount('account', input.account) is only invoked in the singleExtendPerTransaction branch; the dense-packing branch and getWriteInstructionPlan pass inputs straight through to the generated builders, which handle resolution themselves. The two new tests (PDA tuple and { address } carrier) hit the resolving branch and assert identical packing to the plain-Address case — good regression coverage for the one spot where a missed resolution would have produced a wrong-but-not-crashing plan (growth comparison never matching → every extend in its own transaction).
• Rust swap direction — ExtendCpiBuilder::add_remaining_account(account, is_writable, is_signer) pushes (account, is_writable, is_signer), and __remaining_accounts is documented as (AccountInfo, is_writable, is_signer). The new is_writable: .1, is_signer: .2 mapping is the correct one.
• Generated initialize.ts now threads { programAddress } into findCanonicalPda / findNonCanonicalPda. This is a renderer-level fix that rides along with the bump: previously, calling getInitializeInstructionAsync with a custom config.programAddress would still derive the metadata PDA against the default program ID. Worth a line in the release notes.

Notes for the release / subsequent reviewers

• Rust crate: this is a behaviour change for CPI callers. Any downstream program that passed remaining accounts via invoke_with_remaining_accounts / add_remaining_account(s) and worked around the old bug by swapping the bools will now get the opposite roles. It's a correctness fix so it should ship, but it deserves a callout in the Rust crate's changelog/release notes rather than being buried under "regenerate clients".
• JS peer floor ^8.3.0 will be a hard error for consumers on Kit 8.0–8.2 at install time. Expected and unavoidable given the new types, but the JS release note should say so explicitly.
• No .changeset/ directory or CHANGELOG.md in the repo, so nothing to add there.
• Optional follow-up (not for this PR): MetadataInput, resolveMetadataPda, and the getCreate{Canonical,NonCanonical}BufferInstructionPlan / getPdaBufferInstructionPlan inputs still take narrow Address / TransactionSigner. That's a reasonable scope boundary — they do their own PDA derivation on .address — but if the goal is "any Kit-style input works everywhere", those are the remaining surfaces.
• The clients/js/pnpm-lock.yaml churn (−1617/+763) is large but is just dedupe from the Kit/System bump; nothing to review there beyond CI being green.