feat(refund-vault): add oracle aggregator + median-based dynamic refund policy engine - #262

…in roles

Adds a new `governance` contract that closes the single-admin-key SPOF on
ReceiptAnchor's merchant role: a fixed set of weighted members propose a
call, vote on it over a bounded window, and once "yes" weight clears a
configured quorum and outweighs "no", anyone can execute it. No change to
the governed contract is needed — the host's own self-authorization rule
(a contract's require_auth() on its own address auto-succeeds when it is
the direct caller) carries the authority through when Governance calls
into ReceiptAnchor's existing merchant-gated functions, the same mechanism
already used for a MultisigAccount admin.

ReceiptAnchor has no upgrade entry point, and docs/ADR-003-upgradeability.md
(accepted) forbids adding one without reopening that ADR, so this wrapper
gates only the admin surface that actually exists today
(set_min_anchor_interval, anchor_batch, prune_batches) rather than
introducing upgrade authority.

Storage is kept small on purpose: each member's weight is its own
persistent entry, per-voter "already voted" markers live in temporary
storage so they expire with the voting window on their own, and a
resolved proposal's calldata can be reclaimed immediately via
prune_proposal instead of waiting on archival.

Also fixes two pre-existing, unrelated build breaks discovered while
wiring up governance's own tests, both required just to get `cargo build`
/ `cargo test` working across the workspace again:
- receipt-anchor and refund-vault Cargo.toml declared their optional
  `budget_macros` dependency under [dev-dependencies], which Cargo
  disallows (optional dev-dependencies are not permitted); moved it to
  [dependencies], still gated by the `budget-assert` feature and only
  referenced from a #[cfg(test)] module, so it never links into a real
  build.
- receipt-anchor's test_shared_vectors_cover_required_edge_cases used the
  bare `Vec` identifier, which resolves to soroban_sdk::Vec (imported at
  the top of the file) instead of std's Vec, and doesn't implement
  FromIterator<&str>; qualified it as std::vec::Vec explicitly.

Note: contracts/refund-vault/src/lib.rs has a separate, still-unfixed
issue — add_oracle (added in #262) is missing its body/closing brace and
currently fails to compile at all. Left alone here since it's unrelated
to this change and its intended whitelist-insertion logic isn't specified
anywhere I could find.