dgb: tip_hash() accessor + previousblockhash wire (Stage 4c)

[frstrtr]

Stacked on #212. Stage 4c continuation: wire previousblockhash into the work template via a new HeaderChain tip_hash() accessor; bits stays HELD (V37 MultiShield-V4 wall) — surfaced as [decision-needed].

What lands

• HeaderSample gains block_hash (u256; 0 == not populated here, same sentinel as pow_hash).
• HeaderChain::tip_hash() -> optional: newest header id, or nullopt when empty / tip hash unset.
• get_current_work_template emits previousblockhash as GBT big-endian display hex ONLY when tip_hash() is present — truthful conditional, never fabricated.

What is HELD

• bits: no faithful embedded V36 next-target. DGB Core retarget is MultiShield V4 (global 5-algo window) == V37; the ingest path already demotes that gate to a no-op. Emitting a digishield-derived bits = a known-wrong value. Authoritative bits is the external-daemon GBT value, not plumbed into this embedded path yet. [decision-needed] to integrator.
• previousblockhash output: still absent on todays chain state — block_hash is only populated once the embedded P2P header ingest -> validate_and_append wiring lands (following slice). This PR is the accessor + emit-gate prereq (mirrors dgb: track absolute block height in HeaderChain (M3 §4c prerequisite) #209 tip_height).

Scope / safety

• Fenced to src/impl/dgb (4 files). No shared base / bitcoin_family touch.
• Test cases added to EXISTING targets only: header_chain_test 31->35, dgb_work_source_test 15->16. No new gtest target -> build.yml allowlist unchanged (ci: build test_dgb_subsidy in both Linux test jobs (fix master-red NOT_BUILT) #143 trap avoided).
• GPG-signed. Both targets green locally.

HOLD merge.