Add add-invulnerables subcommand and Bulletin Polkadot support

[karolk91]

New subcommand that builds a StakingAdmin-track proposal adding invulnerable collators to a system chain:

opengov-cli add-invulnerables --network bulletin-polkadot --who <SS58> --who <SS58> --verify-via wss://bulletin-rpc.polkadot.io

• One collatorSelection.addInvulnerable per account; multiple accounts are wrapped in utility.forceBatch so one failing addition doesn't revert the rest.
• For any chain other than Asset Hub, the call is wrapped in polkadotXcm.send with Transact { origin_kind: Xcm }: the referendum's StakingAdmin origin arrives on the target as the (AssetHub, Plurality { id: Defense, part: Voice }) voice that every system chain's CollatorSelectionUpdateOrigin accepts. For Asset Hub itself the proposal is the bare call (local StakingAdmin origin).
• Accounts accepted as SS58 (any prefix, warns on mismatch) or 0x-hex; duplicates rejected.
• --verify-via <WSS_URL> (optional): connects to the target chain and verifies before writing anything — the node serves the expected para id, every account has session.nextKeys registered (the ValidatorRegistration precondition of addInvulnerable), none is already invulnerable, and the resulting set fits MaxInvulnerables. Uses the dynamic subxt API, so it works even if the checked-in metadata has drifted.
• Prints the follow-up submit-referendum --track staking-admin command, same flow as build-upgrade.
• Encointer is rejected with an explanation: its UpdateOrigin is MoreThanHalfCouncil, not StakingAdmin.

Bulletin Polkadot support

• New Network::PolkadotBulletin (para 1010) with metadata/polkadot_bulletin.scale (v16, fetched from wss://bulletin-rpc.polkadot.io).
• build-upgrade gains --bulletin, defaulting to the relay version like the other system chains (release assets bulletin-polkadot_runtime-v*.compact.compressed.wasm are published since v2.2.0).

Misc

• scripts/update-metadata.sh regenerates all metadata snapshots from public endpoints — documents where the .scale files come from and makes refreshing them one command.
• Five new tests (20/20 passing). Encoding assertions pin the pallet/call indices and the XCM wrapper structure (dest para 1010, OriginKind::Xcm) against the checked-in metadata, so a metadata refresh that changes them fails loudly.

Tested against the live chain: a verification run via wss://bulletin-rpc.polkadot.io correctly reports registered session keys, flags already-invulnerable accounts and missing session.setKeys, and exits non-zero without writing a proposal.