fix: validate remaining in withdrawn event and prevent negative balance

[Hu-ter]

Overview

This PR fixes the validation gap in events::withdrawn by adding the missing non-negative check for remaining. It also updates the internal _withdraw calculation so a negative remaining cannot be produced in the first place, ensuring the withdrawn event only ever emits non-negative values for amount, total_withdrawn, and remaining.

Related Issue

Closes the reported issue: events::withdrawn validates amount and total_withdrawn but not remaining.

Changes

🔒 Event Validation

• [MODIFY] contracts/stream/src/events.rs
  • Add assert_non_negative_amount(env, remaining); alongside the existing amount and total_withdrawn checks.
  • All three i128 fields on the withdrawn event are now guarded against negative values.

🛠️ Safe Withdrawal Math

• [MODIFY] contracts/stream/src/lib.rs
  • Update the _withdraw computation so remaining cannot be derived from an unchecked tk.balance() - to_send subtraction.
  • Use a guarded/checked subtraction so over-withdrawal is rejected before a negative remaining can be published.
  • Existing amount and total_withdrawn validation behavior is unchanged.

Verification Results

cargo test --package stream
✅ all tests passed

Manual acceptance check:
✅ `withdrawn` rejects negative `remaining`
✅ `_withdraw` cannot compute a negative `remaining`
✅ `amount` and `total_withdrawn` negative guards remain intact

Acceptance Criteria	Status
remaining is validated as non-negative in events::withdrawn	✅ Added assert_non_negative_amount(env, remaining)
_withdraw cannot produce a negative remaining	✅ Unchecked subtraction replaced with guarded computation
Existing amount / total_withdrawn validation is preserved	✅ Existing checks unchanged and passing
Stream contract tests continue to pass	✅ cargo test --package stream passes

Closes #392

[drips-wave]

@Hu-ter Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits