Security: Attestation verification negative suite (Issue #399)

Expands the optional ed25519 oracle-attestation (Issue #263) test coverage with a full
negative suite, restores missing ContractError variants that prevented the contract
library from compiling, and documents the attestation threat model.

What changed

contracts/src/tests/attestation.rs

• Converted the two #[should_panic] tests (wrong-key and tampered-price) into
  structured try_resolve_round assertions that check the rejection is a fail-closed
  host trap (Err(Err(_))) and that the round remains active for a legitimate oracle
  to settle later — #[should_panic] only proves the call aborts, not that state is
  untouched.
• New negative cases (all rejected when a key is configured, round stays resolvable):
  • malformed signature (well-formed 64 bytes, but not a valid ed25519 signature),
  • tampered timestamp after signing (invalidated at the attestation gate, before the
    window check),
  • tampered nonce after signing.
• Disabled-mode compatibility: when no attestation key is configured, an
  attacker-supplied garbage signature field is ignored and settlement proceeds exactly
  as pre-Oracle rebuild: domain-separated signed attestations #263 (account auth only).
• Valid signature does not bypass the nonce replay guard: a pre-consumed nonce is
  still rejected with OracleNonceReused even with a perfectly valid attestation; a
  fresh nonce with the same key still settles (proving the guard is nonce-specific).
• Confidence is advisory: attaching confidence after signing does not invalidate
  the attestation (it is deliberately excluded from the signed message).
• Domain-separation unit test for _build_attestation_message: fixed prefix
  (XELMA_ORACLE_ATTESTATION_V1), deterministic bytes, and each bound field
  (network_id, contract_addr, round_id, price, timestamp, nonce) changes the message
  while confidence/attestation do not.

contracts/src/errors.rs

• Restored 4 ContractError variants that were referenced by the code but missing from
  the enum, which made the library fail to compile: OracleHeartbeatUnhealthy (89),
  AccessDenied (90), DisputeWindowExpired (91), ClaimLocked (92).
• cargo build --package xelma-contract now succeeds.

SECURITY_REVIEW.md

• Added a short attestation threat note: fail-closed verification, domain-separated
  message binding (network/contract/round/price/time/nonce), confidence excluded,
  signature vouches for binding not price correctness (single-oracle trust still
  applies, see SR-2026-04-004), and disabled-by-default behaviour.
• Updated the ContractError variant count to 29.

docs/ORACLE_OPERATOR_RUNBOOK.md

• Added the missing attestation and confidence fields to the OraclePayload reference
  plus a concise attestation threat-note block for operators.

Verification

• cargo build --package xelma-contract passes (36 pre-existing warnings only).
• Empirically confirmed against Soroban SDK 23.0.1 that a bad ed25519 signature traps
  as a host error (Err(Err(_))), contract errors surface as Err(Ok(_)), and success
  as Ok(Ok(_)) — the new assertions match real runtime behaviour.
• cargo test --package xelma-contract --no-run: zero errors reference
  attestation.rs; the remaining errors are pre-existing drift in unrelated test modules
  (leaderboard, security, goldens, precision, etc.).

Pre-existing blocker (not introduced by this PR)

The contract test suite cannot currently be executed: enabling soroban-sdk/testutils
breaks the pre-existing #[contracttype] derive on MarketSnapshot
(Option<RoundPhase> / Option<RoundPoolStats>, contracts/src/types.rs:492), which
blocks cargo test for every module. Recommend a follow-up issue to pin the
soroban-sdk macro stack consistently.

Closes #399