fix: meter expected program reverts with nonzero exit codes

[3esmit]

This PR is a draft pending logos-execution-zone#837, which provides the host support needed for consumed-cycle fee charging.

Closes #356.

Expected errors currently panic and discard the executor session. This change makes token, AMM, ATA, stablecoin, and TWAP oracle rejection paths halt with nonzero exit codes, retaining consumed cycles and committing no program output.

Program-local codes distinguish invalid inputs or state (1), insufficient balances (2), and arithmetic limits (3). Shared explicit abort helpers preserve native panic diagnostics for host callers and tests. Internal invariant failures continue to panic, including malformed system-clock state and fixed-size serialization failures.

The pinned SPEL entry point also panics during account validation. A metered entry adapter derives dispatch from the existing instruction declarations, reuses SPEL's generated validators and handlers, and preserves claims and output filtering. It additionally meters malformed instruction data and account-count failures. Instruction layouts, account formats, PDA seeds, dependency versions, and IDL artifacts remain unchanged.

Instruction decoding checks string and byte-buffer lengths against the remaining words before allocation, including nested values. This closes a case where a short malformed payload such as [1, 0x80000000] caused an allocator panic instead of a metered rejection. Primitive decoding, padding, and acceptance of trailing words retain the pinned RISC Zero behavior.

Validation passed: 626 unit tests, 85 integration tests, workspace and guest Clippy, formatting, IDL consistency, and release builds of all five programs. Twelve executor regressions cover every program, signer/init/count validation, malformed instructions and string lengths, oversized token input, balance and arithmetic failures, a failing ATA-to-token chained call, successful transfer boundaries, and an internal panic that must still discard the session. Seven decoder tests check compatibility, nested length validation, packed bytes, and existing error behavior.

These tests verify guest exit codes, retained cycles, and empty revert journals directly; they do not assert the host fee behavior supplied by the pending LEZ change. All guest ImageIDs change, so deployment must refresh program IDs and derived account addresses together.

[erhant]

Thanks for handling this! logos-blockchain/logos-execution-zone#837 is merged but the release is yet to be live, I will let you know 🙏🏻