feat: add cross-chain bridge and message verification analysis

[tunmisedasa]

Summary

• Implements production-grade cross-chain bridge and message verification analysis with 16 rules (CP-BRG-001 through CP-BRG-016)
• Adds normalized bridge contract modeling, framework adapters (lock-mint, burn-release, optimistic, multisig validator, Merkle proof, LayerZero/Wormhole/Axelar-style), message flow tracing, proof loop analysis, and payload taint tracking
• Integrates into scanner, CLI (chainproof bridge), public API, server rule registry, and versioned configuration

Architecture

Core logic lives in packages/core/src/bridge/ following the governance/staking engine pattern:

• Model builder classifies bridge state (nonces, domains, validator sets, Merkle roots) and transitions (send/receive/verify/lock/mint/burn/release)
• 16 deterministic rules detect missing domain binding, replayable messages, verification bypasses, weak validator transitions, stale roots, unsafe quorum math, unvalidated payload execution, mint-without-lock, release-without-burn, missing finality windows, and absent operational mitigations
• Mitigation recognition suppresses findings when pause guards, rate limits, replay maps, two-phase validator updates, or delayed finality are present

Precision/Recall

• Vulnerable fixtures trigger expected rules (replay, verification bypass, mint-without-lock, payload execution, burn-release gaps)
• Secure fixtures produce zero findings with correct framework adapter matching
• False-positive controls: internal mint/release functions excluded from cross-chain message rules; bare interfaces filtered from model relevance

Test plan

• npm run build
• npm run test:ci --workspace=packages/core (339 tests pass)
• Bridge analyzer unit tests with vulnerable/secure fixtures
• CLI chainproof bridge command registration
• Manual scan of examples/contracts/bridge/ via chainproof scan

Security boundaries

• Static analysis only; no live-network dependencies in CI
• Does not prove transport authenticity or oracle correctness (documented assumptions)
• Bounded resource limits, cancellation support, sanitized error messages
  closes Build Cross-Chain Bridge and Message Verification Vulnerability Rules #83