Contracts: Guardian (pause-only) role distinct from admin for incident response

[joelpeace48-cell]

Context

Incident response should be fast (pause) but pausing should not require the high-privilege admin key,
and the pauser should not be able to move funds. Today only admin can pause.

Scope

• Dedicated guardian address that can set pause flags and cancel timelocked proposals only.
• Admin grants/rotates the guardian.

Acceptance criteria

• Guardian can pause/cancel but cannot withdraw/upgrade/change rates.
• Tests for boundary.