v21_group_vesting

Real on-chain vesting (x/group_vesting). Locked allocations sit in a module account and the beneficiary pulls what has opened; shared rolling sell caps; timelocked beneficiary change; owner-wallet stolen-key path with a hold and a gov vote. The migration moves no money and the module stays disabled until a separate vote. Rehearsed on a copy of the live state with an end-to-end vesting flow. Signed binaries: https://sunima.uk/chain/upgrades/v21_group_vesting/