Fix governance queue, migration freeze, and revocation scope

[carrion256]

Summary

• A-102 / 2ebfb469-1ead-41a7-b58b-9d11224efa3b: skip pending-queue schedule/save for immediately accepted governance submissions; immediate proposals now rely on submitted/accepted events and only persist the queue when replacing an existing pending same-key proposal.

Fixes three medium governance-control-plane findings in one cohesive Soroban governance/runtime patch:

• A-036 / ed860a7d-48be-4376-bdae-09f87e737446: add an explicit pending proposal cap before scheduling new timelocked proposals, while preserving replacement and immediate-action behavior.
• A-037 / 05cb8c51-e843-4f72-aadc-3a3ef9f73115: reject governance command execution while the vault migration flag is active via a centralized command-boundary guard.
• A-038 / fed4779d-4d92-4f47-92d0-9f06052ca303: replace broad revoker authorization with role-scoped revocation checks derived from the proposal kind.

Verification

RED before fix:

• cargo test -p templar-soroban-governance pending_queue_cap -- --nocapture failed on queue overflow returning Ok(65) instead of Err(InvalidInput).
• cargo test -p templar-soroban-governance guardian_cannot -- --nocapture failed with guardian revoking fee proposals by id/kind.
• cargo test -p templar-soroban-governance sentinel_cannot -- --nocapture failed with sentinel revoking Other/Governance proposals.
• cargo test -p templar-soroban-runtime test_execute_governance_config_rejected_while_migration_in_progress -- --nocapture failed with governance config mutation succeeding during migration.
• cargo test -p templar-soroban-runtime test_execute_governance_skim_rejected_while_migration_in_progress -- --nocapture failed without the typed migration guard.

GREEN after fix:

• cargo test -p templar-soroban-governance pending_queue_cap -- --nocapture
• cargo test -p templar-soroban-governance guardian_cannot -- --nocapture
• cargo test -p templar-soroban-governance sentinel_cannot -- --nocapture
• cargo test -p templar-soroban-runtime test_execute_governance_config_rejected_while_migration_in_progress -- --nocapture
• cargo test -p templar-soroban-runtime test_execute_governance_skim_rejected_while_migration_in_progress -- --nocapture
• cargo fmt --all -- --check
• cargo test -p templar-soroban-governance -- --nocapture
• cargo test -p templar-soroban-runtime --lib -- --nocapture
• git diff --check
• just -f contract/vault/soroban/justfile build
• just -f contract/vault/soroban/justfile size-budget-check — runtime deploy WASM 94425 bytes <= 131072 bytes

Post-commit hook also re-ran size-budget-check successfully at 94425 bytes.

A-102 verification

• cargo test -p templar-soroban-governance pause_immediate_unpause_timelocked -- --nocapture
• cargo test -p templar-soroban-governance pending_queue_cap_does_not_block_immediate_pause -- --nocapture
• cargo test -p templar-soroban-governance -- --nocapture — 34 passed
• git diff --check
• just -f contract/vault/soroban/justfile size-budget-check — deploy WASM 94145 <= 131072
• commit 3837cf4 (fix: skip immediate governance queue persistence)

---

This change is 

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b017f627-612c-43ce-8bdc-2fca8e376e93

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch audit/governance-medium-a036-a037-a038

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[carrion256]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.