[BUG] treasury.rs, burn.rs, emergency_recovery.rs, and governance-gated upgrade.rs are fully implemented but never wired into any contract entrypoint

[N-thnI]

Priority: High

Description

engine-core ships two production contracts: ControlPlane and UpgradeableProxy. Neither calls into treasury::*, burn::*, emergency_recovery::*, or the top-level governance-gated upgrade::upgrade (distinct from UpgradeableProxy::upgrade). Every pub fn in these four files is exercised only by each file's own #[cfg(test)] module — dead code from the deployed WASM's perspective. Concretely: no emergency fund-recovery path, no treasury outflow timelock enforcement, no burn safety checks, and the only reachable upgrade path is UpgradeableProxy::upgrade, which is single-admin-gated with no governance/multi-sig/timelock requirement at all.

Location

engine-core/src/emergency_recovery.rs:36,53,87, engine-core/src/treasury.rs:60,69,102,141, engine-core/src/burn.rs:17,32, engine-core/src/upgrade.rs:16

Current Behavior

// zero callers outside each file's own tests
pub fn request(env: &Env, requester: &Address, token: &Address, dest: &Address, amount: i128) {
    crate::non_reentrant!(env);
    assert_closed(env);
    requester.require_auth();
    require_admin(env, requester);
    ...
}

Expected Behavior

Each module's state-changing functions should be exposed through ControlPlane with appropriate role gating, exactly as governance::propose/approve/execute and circuit_breaker::trip/reset already are.

Repro / Evidence

grep -rn "treasury::" --include="*.rs" engine-core/src        # only treasury_tests.rs
grep -rn "emergency_recovery::" --include="*.rs" engine-core/src  # zero outside file
grep -rn "burn::" --include="*.rs" engine-core/src             # zero outside file
grep -rn "crate::upgrade\b" --include="*.rs" engine-core/src   # zero anywhere
grep -rln "#\[contractimpl\]" engine-core/src                  # only control_plane.rs, proxy.rs

Impact

The protocol, as currently deployable, has no emergency fund-recovery path, no treasury timelock, no burn safety checks, and no governance-gated upgrade path — a materially broader gap spanning the protocol's entire fund-safety and upgrade-governance surface. Anyone reading the source would reasonably assume these protections are active; they aren't.

Suggested Fix

Expose role-gated wrapper entrypoints for each module in ControlPlane (mirroring the existing propose/approve/execute/trip_breaker pattern), or explicitly gate/feature-flag these modules out of release builds until wired, with a CI check preventing silent dead-security-code shipping.

Acceptance Criteria

• AC-1: ControlPlane exposes reachable, role-gated entrypoints for all four modules, OR they're explicitly documented/gated as inactive with a CI check.
• AC-2: New integration tests calling each flow through ControlPlaneClient (not the internal function directly) — fail on current code (no such client methods exist).

Definition of Done

• Fix merged with all AC items checked
• Regression test passes in CI
• No new clippy warnings