test: cover Halborn test assurance gaps

[carrion256]

Summary

Adds production-parity test assurance coverage for the Halborn test-harness findings, with one fix commit per finding token:

• 8d1fd652 — #FIND-068 / 4cb3451f-337d-4592-b11d-b1120fa14be2: native auth coverage must not be implied by permissive role checks.
• e9cc5c3d — #FIND-069 / 6c4d6806-a811-43d0-8b6f-9a300397ab7c: allocation helper parity with production allocation state transitions.
• e0d95e3b — #FIND-071 / 65436862-bc61-4b3d-91d0-2d2c62b59f01: initialization/onboarding storage/config coverage through the production entrypoint.
• 3c8eb81d — #FIND-073 / 01a4c1b0-d06e-48ac-a003-c4d0138d9c87: property-test external-growth wording corrected to reflect mock interpreter behavior, with explicit production growth coverage.
• 1d254e79 — #FIND-074 / eece8f19-9cbc-4091-af90-d5fd3a4f114f: fee/preview conversion parity test uses the live proxy view path.
• d7cb3d2d — #FIND-075 / 312a8142-9e1b-44a3-8928-3e029626d060: high-value Soroban proxy-view conversion parity coverage is explicitly documented.
• 31137e26 — #FIND-076 / a463103a-4082-4557-83b8-0c001983f56d: malformed vault/governance command decode coverage.
• 75edc6c1 — #FIND-081 / d4706fd9-fc8b-4718-9931-c71f21d80585: SorobanAuth tests distinguish native require_auth from role-policy checks.

Verification

• cargo fmt --all
• Focused tests:
  • cargo test -p templar-soroban-runtime verify_and_authorize_requires_native_auth_even_for_public_actions --lib -- --nocapture
  • cargo test -p templar-soroban-runtime verify_and_authorize_records_native_auth_and_preserves_role_errors --lib -- --nocapture
  • cargo test -p templar-soroban-runtime test_initialize_onboards_default_storage_and_config --lib -- --nocapture
  • cargo test -p templar-soroban-runtime test_begin_allocating_helper_matches_production_begin_state --lib -- --nocapture
  • cargo test -p templar-soroban-runtime test_direct_supply_allocation_covers_production_completion_flow --lib -- --nocapture
  • cargo test -p templar-soroban-runtime test_complete_refresh_with_positions_accounts_for_external_growth --lib -- --nocapture
  • cargo test -p templar-soroban-runtime test_proxy_view_uses_fee_aware_kernel_conversions_for_high_values --lib -- --nocapture
  • cargo test -p templar-soroban-shared-types vault_command_decode_rejects_malformed_payloads_by_error_class -- --nocapture
  • cargo test -p templar-soroban-shared-types governance_command_decode_rejects_incomplete_nested_payloads -- --nocapture
• Broader affected gates:
  • cargo test -p templar-soroban-shared-types -- --nocapture
  • cargo test -p templar-soroban-runtime --lib -- --nocapture (110 passed)
  • cargo test -p templar-soroban-runtime --test property_tests -- --nocapture (23 passed)
• git diff --check
• post-commit Soroban size-budget-check passed during commits (93961 bytes)

Notes

Test-only/shared-types unit coverage. No production runtime behavior change.

---

This change is 

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 212fc298-f605-4997-a509-da839806942b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch audit/test-assurance-harness-a068-a081

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}