Wire the guardian to the oracle ripcord

[luchobonatti]

User story / Problem statement

The oracle ripcord is gated on the oracle's admin, so raising it needs the same high-threshold multisig that clears it. During a feed incident that is backwards: raising a brake should be fast and cheap, clearing it should be deliberate. The vault already works that way, where a guardian pauses and only the admin resumes.

Expected outcome

The same asymmetry on the oracle: a guardian raises the ripcord, only the admin clears it.

Acceptance criteria

• a guardian role wired at the oracle constructor
• set_ripcord to raise is gated on guardian
• clearing stays gated on the oracle admin
• test: the guardian can raise but cannot clear
• test: the admin can clear
• while raised, the feed reports Paused and nothing consumes the value
• until this lands, the runbook carries the interim: the admin raises it

Technical notes

Blocked on #8 accepting ADR-0018.

Raising can only ever prevent, which is why a single fast key is acceptable for it. Clearing resumes pricing for every strike that follows, which is the judgment call.

The vault's own pause is the precedent, and its scope is already anchored by pause_freezes_deploy_and_intake_but_never_exits.