fix: implement audit findings 2–20

[1kresh]

Summary

• harden the shared transaction lifecycle with canonical receipt supervision, bounded same-nonce replacement, explicit retry-safe states, single-endpoint broadcasts, and joined workers
• fix RFQ executable-order binding, fail-closed authorization/pause handling, adapter terminology, amortized fill-plan eviction, and prompt nested-fatal propagation
• secure OEV WebSocket transport, component freshness, result deduplication, pinned-block Morpho accounting/IRM reads, and bounded bundle search
• make 3F offer TTL, identifiers, rate arithmetic, webhook transport, and salted EIP-712 domains exact, with fail-closed partial redemption scans and hermetic boundary coverage
• pin Go 1.26.5, bound generated-client responses, verify deterministic code generation, preflight/redact RPC endpoints, and reconcile operator/maintainer documentation
• preserve the public stage OEV strategy split, LI.FI client generation, and protected generated paths while transplanting the audit fixes

Why

This implements audit findings 2–20. Finding 1 is intentionally excluded. The previous implementation could conflate ambiguous transaction outcomes with safe retries, allow RPC fallback provenance to change broadcast classification, trust incomplete protocol projections, and leave several external-input and worker-lifecycle boundaries insufficiently bounded.

Impact

Operators get fail-closed protocol behavior, explicit transaction outcomes, hardened RPC/HTTP/WebSocket boundaries, and updated configuration/documentation. The generated 3F webhook field maxRateBps is now an exact decimal string. Read RPC fallbacks remain available, while transaction broadcasts use only writeRpcUrl or the primary rpcUrl.

This branch is based directly on the public repository's stage branch; private-only deployment history was not imported.

Pre-existing follow-ups

Final review also recorded three stage issues that this range did not introduce: secret-indirection fields can be misconfigured with YAML interpolation and echoed as supposed env-var names; 3F startup adapter resolution does not validate Multicall result cardinality; and LI.FI regeneration uses GNU mktemp syntax, so that target is Linux-CI rather than native-macOS portable. They are outside findings 2–20 and remain follow-up work before treating the draft as merge-ready.

Validation

• go build ./...
• go test -count=1 -race -cover ./...
• golangci-lint run --fix and golangci-lint run — 0 issues
• make check-generated
• go mod tidy -diff and go mod verify
• OEV live-tag compile
• OEV bundle benchmarks through 10,000 candidates
• independent whole-branch and final-delta review with no remaining range findings