Reputation Merkle-sum tree with incremental on-chain scoring

[cyber-punk112]

• Reputation MST ([CRITICAL][Tier-A] Reputation lazy Merkle-sum tree with incremental on-chain scoring #387): replaces compute_score's linear scan (~200 cross-contract get_trade_by_index + get_trade calls) with a Merkle-sum tree maintained by the escrow contract. Leaves are written on release/refund/batch_release/resolve_dispute/fallback_after_timeout; the reputation contract now fetches one ScoreProof + the current root (two cross-contract calls total) and verifies each leaf locally instead of scanning. MAX_TRADES raised from 200 to 10,000. Added compute_score_incremental, which only re-verifies leaves past the last cached index. The external compute_score(address) signature is unchanged, and existing escrow events are untouched.

Verification notes (per repo convention, no CI run in this environment):

• cargo check --tests passes cleanly for htlc-core and escrow (workspace members) and for the reputation crate (checked standalone, see below) — only pre-existing deprecation warnings, no errors introduced by this change.
• cargo test could not be executed for the reputation crate here: it hits a Windows-GNU linker limit (export ordinal too large) when linking the soroban-sdk dependency graph as a DLL — an environment/toolchain issue unrelated to this change, not something introduced by it.
• Important pre-existing condition discovered while checking: the reputation crate is not listed in contracts/Cargo.toml's workspace members (nor excluded), and independently of that, jury_arbitration.rs/jury_tests.rs and the DECAY_TABLE constant (declared [u32; 366] but with only 365 entries) already fail to compile on main, unrelated to reputation scoring. None of that was touched here — out of scope per the instructions not to fix a pre-existing broken build/test setup — but it's worth flagging since it means the reputation crate currently isn't exercised by any workspace-wide cargo test/CI run.
• New tests (contracts/htlc-core/src/mst.rs's own unit tests, contracts/reputation/src/mst_test.rs, contracts/reputation/src/benchmarks.rs) use plain #[test] functions with a small deterministic PRNG for "randomized" coverage rather than adding a property-testing dependency to the reputation crate (proptest already exists in escrow's dev-dependencies but not reputation's).

Closes #387

[vercel]

Someone is attempting to deploy a commit to the jotelfootball-tech's projects Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
velo	Ready	Preview	Aug 27, 2026 6:43pm
velo-frontend	Ready	Preview	Aug 27, 2026 6:43pm

[jotel-dev]

Hey @muhammad-codes112. Thanks for this, two things to resolve before merge:

1. contracts-ci / test is failing after ~8s — could you check the logs and fix that up?
2. There's a merge conflict in contracts/escrow/src/lib.rs — could you pull the latest main and resolve it there?

Since this touches escrow contract code, let me know once both are sorted and I'll take a close look at the logic.