feat(core): detect ERC-4626 vault share-price inflation attacks (CP-122)

[dragoncode-01]

Summary

Implements CP-122 to detect ERC-4626-style share-price inflation and first-depositor donation attacks.

The detector identifies vaults that:

• Expose deposit/mint and withdraw/redeem share-accounting flows.
• Mint shares using a naive assets * totalSupply / totalAssets ratio.
• Derive total assets from the token’s live balanceOf(address(this)).
• Lack protections such as virtual assets/shares, dead shares, minimum-liquidity initialization, or transfer-independent internal accounting.

Changes

• Added the CP-122 AST-based detector.
• Integrated CP-122 into standalone and inherited-contract scanning.
• Added high-severity, contract-specific remediation guidance.
• Added vulnerable, dead-share-protected, and unrelated-ratio fixtures.
• Added unit and scanner-integration tests.
• Registered CP-122 in the server rule registry.
• Documented CP-122 in the README vulnerability rules table.
• Removed a duplicate core export that prevented TypeScript compilation.

Detection Strategy

To reduce false positives, a finding requires all of the following signals:

1. Vault-style deposit/mint and withdraw/redeem entry points.
2. Share-minting behavior.
3. Total-supply/total-assets share-conversion arithmetic.
4. Asset accounting based on the vault’s live token balance.
5. No recognized inflation-attack mitigation.

Unrelated proportional arithmetic outside a vault context is not reported.

Verification

• All workspace builds pass.
• Core tests: 154 passed.
• CLI tests: 2 passed.
• Vulnerable fixture produces one high-severity CP-122 finding.
• Protected fixture scans clean.
• Unrelated ratio-math fixture scans clean.

Closes #67