Fixes #1295: implement state-transition invariants for admin and arbi…

[TheShnider]

Description

Closes #1295

Type of Change

• feat — new functionality
• fix — bug fix
• docs — documentation only
• refactor — code restructuring with no behaviour change
• test — test additions or improvements
• ci — CI configuration changes
• chore — maintenance, dependencies, tooling

How Has This Been Tested?

• cargo test --workspace passes
• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets --all-features -- -D warnings passes
• Coverage ≥ 95% for affected crates (cargo llvm-cov --package <crate> --fail-under-lines 95)
• Fuzz harness passes (cargo test -p credence_bond fuzz::test_bond_fuzz -- --nocapture)
• Error code wire-stability test passes (cargo test -p credence_errors error_codes_wire)
• Release build passes (cargo build --release)

Checklist

• Tests added/updated for new or changed functionality
• Docs updated (if public API, storage layout, error codes, or architecture changed)
• CHANGELOG.md updated (if contracts/** touched)
• Branch follows <type>/<short-description> naming convention
• Commit messages follow conventional commits

Additional Context

[drips-wave]

@TheShnider Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits