feat: timelock tiers, multisig custom account, zenith-common crate, vault escape hatch

[knytcomics-ui]

Summary

• [High] Timelocked Execution Tiers per Action Class #76 Timelock tiers: multisig tracks threshold_reached_at (set when an approval crosses threshold, cleared on a revoke that drops below it or on reset; if an approval expires during the delay, the timer restarts). is_executable(action_id, class) enforces immutable per-class delays set at initialize (Emergency = 0, Standard, Critical). Every consumer _via_multisig fn declares its class (pause = Emergency; upgrade/transfer_admin/vault fund moves = Critical; everything else = Standard). The delay table is in the README.
• [High] Multisig as a Soroban Custom Account (__check_auth) #77 Custom account: CustomAccountInterface::__check_auth on multisig. It requires M distinct ed25519 signer signatures, sorted strictly ascending (so duplicates, unsorted lists and non-signer keys are rejected), with an optional allowed_contracts policy. It works alongside approval mode; the README covers when to use which, plus a CLI signing walkthrough.
• [High] Deduplicate the _via_multisig Pattern with a Shared zenith-common Crate #78 zenith-common: new rlib with require_admin_or_multisig(env, key, Auth, class, err), enum Auth { Admin, Multisig(..) }, and pause/admin helpers. It defines no #[contract] and exports no spec entries. All 21 twins are now x_inner(env, Auth, ..) called from both entrypoints. Multisig is called with invoke_contract, so the per-crate multisig_client.rs files and the multisig wasm build-order dependency are gone.
• [High] Beneficiary Escape Hatch After Prolonged Vault Pause #81 Vault escape hatch: initialize(.., max_pause_duration) (immutable), PausedAt plus cumulative pause accounting (brief unpause/re-pause doesn't reset the clock; only a full unpaused window does), first depositor = tag owner, set_beneficiary (blocked while paused), emergency_withdraw(tag, beneficiary) and an emergency_withdrawn event.

Closes #76
Closes #77
Closes #78
Closes #81

ABI / wasm size (#78)

New CI job spec-diff (tools/spec-diff/check.sh) diffs each contract's spec against the base branch:

• price_oracle, options_market: existing ABI preserved, no additions. Wasm 32218 → 30932 B and 62111 → 60261 B.
• multisig, vault: purely additive, except the intentional initialize signature changes (listed in tools/spec-diff/allow.txt). Wasm 19291 → 30720 B and 25471 → 33623 B. This growth comes from the new [High] Timelocked Execution Tiers per Action Class #76, [High] Multisig as a Soroban Custom Account (__check_auth) #77 and [High] Beneficiary Escape Hatch After Prolonged Vault Pause #81 entrypoints, not the refactor.

Validation

• cargo fmt --check and cargo clippy --all-targets -D warnings pass on every crate.
• cargo test passes: multisig 45, price_oracle 62, vault 48, options_market 110. The existing tests only needed the new initialize args.
• New tests:
  • Per-class delay boundaries, revoke and expiry during the delay, and the emergency bypass.
  • __check_auth with real ed25519 keys: duplicate, unsorted and non-signer signatures, and the policy.
  • Integration: options_market with admin = multisig account performs initialize/set_fee_rate/pause/upgrade through signed auth entries, with no mock_all_auths.
  • Vault escape hatch: time travel across the threshold and the pause/unpause reset attack.

[drips-wave]

@knytcomics-ui Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits