fix(v2): enter reentrancy guard at start of entrypoints (#132)

[xtep103]

Overview

Hoists enter_reentrancy_guard to the start of assert_outcome, dispute, register, and withdraw immediately after require_auth(), closing potential reentrancy windows during early validation and id/state setup.

Related Issue

Closes #132

Changes

Contracts (tholos-v2)

• [MODIFY] contracts/tholos-v2/src/lib.rs
  • Hoist enter_reentrancy_guard to the entry of assert_outcome, dispute, and register immediately after require_auth().
  • In withdraw, replace check_reentrancy_guard with enter_reentrancy_guard at entry.
  • Remove redundant late enter_reentrancy_guard invocations before token transfers.
• [MODIFY] contracts/tholos-v2/src/test.rs
  • Update comment in test_reentrancy_guard_blocks_calls_while_held.
  • Add regression test test_reentrancy_guard_blocks_calls_before_validation verifying ReentrancyGuardActive is returned even when arguments would otherwise fail later validation.
• [ADD] contracts/tholos-v2/test_snapshots/test/test_reentrancy_guard_blocks_calls_before_validation.1.json
  • Test snapshot for the new regression test.

Verification Results

$ cargo fmt --check
$ cargo clippy --workspace --all-targets --locked -- -D warnings
Finished `dev` profile [unoptimized + debuginfo] target(s) in 24.65s

$ cargo test --workspace --locked
test result: ok. 69 passed; 0 failed; finished in 24.03s (tholos)
test result: ok. 108 passed; 0 failed; finished in 14.44s (tholos-v2)

Acceptance Criteria	Status
Guard entered immediately after require_auth() in assert_outcome, dispute, register, and withdraw	✅ Implemented
Existing reentrancy tests and full workspace test suite pass	✅ 108/108 tholos-v2 tests pass, full workspace passes
Regression test covering reentrant call during early validation window	✅ Added test_reentrancy_guard_blocks_calls_before_validation
Code formatting and linter checks pass cleanly	✅ cargo fmt --check and cargo clippy passed

[collinsezedike]

enter_reentrancy_guard's doc comment (contracts/tholos-v2/src/lib.rs:856) still says every guarded function calls it immediately before the transfer, after writing state. That's no longer true after this PR: assert_outcome, dispute, register, and withdraw all call it at the top of the function, right after require_auth, before any validation or state writes. This line isn't part of the diff so I can't anchor a comment to it directly, please update it to describe the new ordering, otherwise a future contributor adding a token-moving entrypoint will copy the stale pattern and reintroduce the exact fragility this issue fixed.

[xtep103]

Thanks for the review. I've addressed the requested changes, including updating the reentrancy guard documentation and improving the regression test coverage. The changes have been pushed to this PR for review.

[collinsezedike]

@xtep103 thank you for the contribution. This looks good, there is nothing to flag.