Fix tx simulate re-assembly dropping auth and double-counting fees

[fnando]

What

Fixes two bugs in assemble() (cmd/soroban-cli/src/assembled.rs) that surface when tx simulate runs on an envelope that is already assembled or partially authorized.

1. Recorded auth is no longer dropped. The requested auth mode is now threaded into assemble(). When an explicit record mode (--auth-mode=root / non-root) is used, the simulation-recorded authorization entries replace the entries already on the transaction. For enforce / unset, the previous behavior is kept: auth is only filled in when the operation has none, so caller-provided entries are preserved.

2. The resource fee is no longer double-counted. If the incoming transaction already carries SorobanTransactionData (ext V1) whose resource_fee is folded into raw.fee, that amount is now subtracted from the inclusion fee before adding the simulated resource fee (only when raw.fee > resource_fee), mirroring the JS SDK's assembleTransaction guard.

Why

Re-simulating an already-assembled/partially-authorized envelope — e.g. re-recording a partially authorized transaction to capture non-root sub-invocation auth — previously silently discarded freshly recorded auth and inflated the fee. Fixes #2603.

Known limitations

When a record mode is requested but the simulation returns empty recorded auth, existing entries are fully replaced (cleared) to match what was recorded — the "full replace" reading of the issue.

[Copilot]

Pull request overview

Fixes tx simulate reassembly to preserve recorded authorization correctly and avoid resource-fee inflation.

Changes:

• Replaces existing auth when explicit recording mode is requested.
• Subtracts an existing resource fee before applying the simulated fee.
• Adds focused unit tests for auth and fee behavior.