feat(access): make caller registry versioned and replay-safe

[Jagadeeshftw]

Summary

• Adds a monotonic version to allowed-caller registry changes.
• Rejects stale updates and returns deterministic results for exact duplicate retries.
• Records one structured caller_registry_changed event per accepted versioned transition.
• Keeps membership, version, replay marker, cooldown, and event behavior atomic.
• Ensures versioned removal blocks new transfer mutations while preserving existing escrow lifecycles.
• Documents authorization, migration, rollback, indexer, recovery, and governance evidence requirements.

Acceptance criteria

• Stale updates fail without changing membership or version.
• Every accepted versioned change emits exactly one audit event.
• Removed callers cannot execute new mutations.
• Duplicate, removal, authorization, cooldown, and event tests added.

Validation

• cargo test — 134 passing, 4 pre-existing ignored fixture/event tests
• git diff --check — clean
• Diff size: 502 changed lines

Security note

Authorization is checked before duplicate disclosure. Exact retries return duplicate: true without a second event, while changed or skipped tuples are treated as stale governance updates. Replay markers are persistent correctness state and are covered by rollback guidance.

Issue

Closes #195