feat: implement freeze auth coverage, registry admin cooldown, and yield lifecycle events

[EmperorNexus]

Overview

This PR implements three GrantFox FWC26 smart-contract issues:

1. Freeze require_auth audit – Adds the CalloraFreeze contract with require_auth on every state-changing entrypoint (freeze, unfreeze, set_freeze_operator, init). Admin + freeze-operator auth model.
2. Registry admin cooldown – Adds a COOLDOWN_SECONDS (1 hour) window between critical admin actions in the registry to prevent rapid abuse.
3. Yield lifecycle events – Adds versioned DistributionLifecycleEvent payloads and distribute_started/distribute_completed emit helpers with snapshot tests.

Related Issues

• Closes Add require_auth coverage audit for freeze [b#071] #896
• Closes Add admin cooldown for registry critical actions [b#049] #874
• Closes Add structured lifecycle events for yield [b#047] #872

Changes

Freeze auth coverage (#896)

• [ADD] contracts/freeze/src/lib.rs – CalloraFreeze Soroban contract with require_auth on init, freeze, unfreeze, set_freeze_operator
  • Admin-or-operator freeze; admin-only unfreeze and operator management
  • Typed FreezeError with stable error codes (1-6)
  • Unit tests (6) + fuzz-style integration tests (7) all passing

Registry admin cooldown (#874)

• [ADD] contracts/registry/src/admin.rs – require_cooldown() / update_cooldown() helpers with COOLDOWN_SECONDS = 3600
• [MODIFY] contracts/registry/src/errors.rs – Added AdminCooldownActive = 9
• [MODIFY] contracts/registry/src/lib.rs – Cooldown checks in register_offering and register_offering_with_gate; LastAdminAction storage key
• 24/24 tests pass (unit + overflow_safe + xcontract)

Yield lifecycle events (#872)

• [ADD] contracts/yield/src/events.rs – DistributionMode enum, DistributionLifecycleEvent versioned payload, emit_distribute_started/emit_distribute_completed helpers, yield_deposited/distribute/batch_distribute topic constructors
• 20/20 events tests pass (including lifecycle snapshot tests)

Verification Results

cargo test -p callora-freeze
13/13 passed (6 unit + 1 err_stab + 6 malformed_freeze)

cargo test -p callora-registry
24/24 passed (2 unit + 15 overflow_safe + 7 xcontract)

cargo test -p callora-yield --lib events
20/20 passed (limits + lifecycle snapshot tests)

Acceptance Criteria	Status
Every state-changing freeze entrypoint calls require_auth	Admin + operator auth on all mutators
Admin cooldown prevents rapid registry actions	1-hour cooldown enforced via require_cooldown + update_cooldown
Yield lifecycle events are structured and versioned	DistributionLifecycleEvent with version, mode, batch metadata
Snapshot tests pin topic bytes	All event topic constructors have byte-identity snapshot tests

Timeline

• EmperorNexus committed

[drips-wave]

@EmperorNexus Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Merged into main via admin resolver (-X theirs).

[greatest0fallt1me]

Merging this one — appreciate the thorough approach!