fix: remediate all Round 3 security audit findings

[0xZunia]

Summary

Addresses 43+ findings across all 13 Round 3 audit issues, spanning every layer of the stack (core, consensus, storage, execution, network, API, SDK, bridge, compliance, confidentiality, explorer, generators, node).

44 files changed — 427 insertions, 152 deletions. 2,334 tests passing, 0 warnings.

Critical (1)

• CRIT-01: MergeForkState discarded non-contract account mutations (balance/nonce changes lost after contract calls). Added GetModifiedAccounts() to IStateDatabase and rewrote merge to iterate all dirty accounts.

High (2)

• HIGH-01: BlockBuilder used parameterless TransactionExecutor constructor (no chain params, no validator). Reordered SetupBlockProduction() to pass pre-constructed executor.
• HIGH-02: Sandboxed SDK dispatch Task was orphaned on timeout, risking cross-contract state corruption. dispatchTask now awaited before scope disposal.

Medium (6)

• MED-01/MED-03 (Consensus): VoterPublicKey binding enforced in BasaltBft and PipelinedConsensus vote/view-change handlers — reject messages where SenderId doesn't match registered public key.
• MED-01 (Execution): ChargeGasAndIncrementNonce now computes actual gas equivalent for proposer tip credit.
• MED-02 (Execution): InsufficientBalance failure paths report tx.GasLimit as GasUsed (not 0).
• MED-03 (Execution): UInt256.TryAdd overflow check in TransactionValidator for value + gasCost.
• NEW-M01 (Network): TcpTransport per-IP counter leaked on failed connections — moved increment after successful connect.
• MED-01 (Compliance): SanctionsList post-add eviction when at capacity.

Low (~25)

• UInt256 hex truncation guard, KeystoreManager key zeroing
• PipelinedConsensus sequential proposal rejection, SlashingEngine atomic percent slash
• ValidatorSet lock on GetByAddress, StateDbRef delegation for GetModifiedStorageKeys/GetModifiedAccounts
• REST multi-read consistency via state fork, PeerInfo dead code removal
• ReputationScorer thread-safe penalty accumulator, EpisubService atomic IWANT rate limiting
• ComplianceEngine defensive copy, BST-1155/BST-3525 checked arithmetic
• ViewingKey/ConfidentialityModule ephemeral key zeroing, BridgeState recipient validation
• GraphQL Mutation logger injection + generic error messages, case-insensitive 0x handling
• Explorer AOT JSON context fix, faucet key zeroing, DataDir symlink resolution
• Global rate limiter (not per-endpoint), CORS restricted to explorer domain
• Codec size comment, BLS PoP documentation note, nullifier reset docs

Informational (3)

• Docker no-new-privileges + cap_drop: ALL on all validators
• GossipService re-serialization dedup comment
• TransportEncryption single-thread assumption documented

Design Decisions (unchanged)

• LOW-05 (Core): UInt256 implicit int conversion — runtime OverflowException on negative values is intentional for ergonomics.
• M-03/R1 (Consensus): WeightedLeaderSelector.StakeToWeight precision — ~0.02% deviation acceptable for leader selection.
• LOW-03 (Consensus): No on-chain BLS Proof-of-Possession — mitigated by P2P-based key exchange.

Test plan

• dotnet build -c Release — 0 errors, 0 warnings
• dotnet test -c Release — 2,334 tests passing across 16 test projects
• All 13 issues (Core Layer Audit Report (Round 3) #56-Node Orchestration Audit Report (Round 3) #68) verified finding-by-finding against source code

Closes #56, closes #57, closes #58, closes #59, closes #60, closes #61, closes #62, closes #63, closes #64, closes #65, closes #66, closes #67, closes #68