feat(escrow): harden upgradeability, version visibility, and onboarding interop

[davedumto]

Summary

Hardens four cross-cutting upgradeability and interoperability concerns in craft-nexus-contract/src/lib.rs:

• [UPGRADEABILITY] WasmUpgradeProposal Unvalidated Upgrade Path #230 — WasmUpgradeProposal is now validated end-to-end: zero-hash rejection, explicit cancel-before-replace, execute_upgrade(expected_wasm_hash) re-check, proposer/timestamp metadata, and lifecycle events (UPG_PROP / UPG_CANC / UPG_EXEC).
• [MAINTAINABILITY] ContractVersion Missing Migration Visibility #241 — Adds a bounded UpgradeHistory log (FIFO-capped at 32) plus get_upgrade_history / get_version_info queries, and documents the ContractVersion semantics on get_version.
• [INTEROPERABILITY] OnboardingContractAddress Unverified Cross-Contract Call #243 — Cross-contract calls to the onboarding contract now route through safe_update_reputation / safe_update_user_metrics, which wrap try_invoke_contract so a malicious or version-skewed onboarding contract cannot trap escrow flows. set_onboarding_contract rejects self-pointers; get_onboarding_contract / has_onboarding_contract / clear_onboarding_contract are public; failed cross-contract calls emit an OB_FAIL warning event.
• [UPGRADEABILITY] FeeTokenIndex Single-Value Upgrade Constraint #239 — Introduces per-token FeeTokenInfo (active / custom_fee_bps / accumulated) at DataKey::FeeTokenConfig(Address), paired with get_fee_token_config / get_fee_tokens / set_fee_token_config / migrate_fee_token_configs. accumulated is contract-owned — admin can flip active or override bps but cannot rewrite historical fee accounting. The legacy FeeTokenIndex Vec remains the canonical enumeration source for backward compatibility.

Behavior changes worth flagging on review

• execute_upgrade() signature gained an expected_wasm_hash: BytesN<32> argument. SDK callers and any deploy scripts must be updated. This is intentional defense-in-depth against signing-tool spoofing where the operator sees a different payload than what is stored on-chain.
• propose_upgrade_wasm no longer silently overwrites a pending proposal — callers receive UpgradeProposalExists and must explicitly cancel_upgrade_wasm first. This prevents a compromised admin from resetting the cooldown clock without an audit trail.
• cancel_upgrade_wasm now returns NoUpgradeProposed when there is nothing to cancel, instead of silently succeeding.
• New error variants: InvalidUpgradeHash, UpgradeProposalExists, OnboardingContractNotSet.
• custom_fee_bps on FeeTokenInfo is storage-only in this PR — calculate_fee does not yet consult it. A follow-up issue can wire it into the fee calculation once the storage shape stabilizes in production.

Out of scope

The pre-existing lib build errors on main (Escrow initializers missing batch_id / funded fields, stake_data scope error) are unrelated to these four issues and intentionally untouched here.

Test plan

• cargo check --lib shows the same 3 pre-existing errors and no new ones (verified locally).
• Test suite has pre-existing breakage on main (~80 errors before this PR); follow-up needed to refresh setup_test for the new execute_upgrade signature and to define the missing onboarding_contract test binding.
• Manual review of the four issue acceptance criteria against the changes summarized above.

closes #230
closes #241
closes #243
closes #239