fix(v1): verify exact incoming token transfer amount to prevent dispute deadlock (#164)

[s6pa1rta3n-lab]

Summary

Resolves #164 by verifying exact-amount balance delta on incoming token transfers and bounding resolution / finalization payouts to the contract's actual balance.

Root Cause

When an assertion or dispute transfer occurs with non-standard tokens (e.g. fee-on-transfer tokens), the contract may receive strictly less than the requested bond amount. Previously, resolve attempted to transfer assertion.bond * 2 regardless of whether the incoming bond transfers delivered the full amount. If the contract's actual token balance was less than assertion.bond * 2, resolve would revert with insufficient balance on payout, permanently deadlocking the disputed assertion.

Solution

1. Balance Delta Verification: Added Error::TransferShortfall (= 23). In assert_outcome and dispute, verified that balance_after - balance_before >= bond_amount. If a fee-on-transfer or defective token delivers less than requested, the transaction immediately rolls back with Err(Error::TransferShortfall).
2. Defensive Payout Capping: In resolve and finalize, capped payout transfers to contract_balance to guarantee that payout execution cannot revert due to shortfall under any circumstance.
3. Tests: Added tests verifying:
   • test_fee_on_transfer_token_rejected_on_assert_outcome: Assertions using fee-on-transfer tokens are rejected upfront.
   • test_fee_on_transfer_token_rejected_on_dispute: Disputes using fee-on-transfer tokens are rejected upfront without altering assertion state.
   • test_resolve_payout_capped_at_contract_balance: resolve safely handles short balances without deadlock.
   • test_finalize_payout_capped_at_contract_balance: finalize safely handles short balances without deadlock.

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC

[collinsezedike]

@s6pa1rta3n-lab Closing. #164 has no assignee. Comment on the issue and wait to be assigned before opening a PR.