Governance control hardening pass: role matrix depth, lock-state events, and audit metadata

[devdeen213]

Summary

This PR delivers a minimal-but-targeted hardening pass across the contract governance/auth support surface referenced in the assigned issue bundle.

What changed

• Expanded the auth matrix coverage to include all key mutating/admin-sensitive entrypoints:
  • migrate
  • prune_history_by_age
  • cancel_admin_proposal
  • set_operator
  • cancel_operator_proposal
• Extended governance event helpers to capture governance lock/unlock lifecycle semantics plus reason/metadata payload support for privileged action auditing.

Why this is minimal

• No broad contract refactor.
• Keeps changes scoped to the exact auth/governance validation files used by backend integration and CI contract behavior checks.

Validation

• Local package/tool runners are unavailable in this environment (npm/pnpm not present), so tests were not executed here.

Closes #218
Closes #219
Closes #220
Closes #221

[drips-wave]

@devdeen213 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits