CYS3-05: Mutable Module Adapters Can Strand Protocol State

[evercoinx]

Note

Medium Risk
Tightens SSPRouter.setAdapter with new revert conditions that can block deployments or upgrades if wiring/order is wrong, and permanently prevents adapter replacement after vault registration.

Overview
Prevents unsafe adapter configuration in SSPRouter.setAdapter by rejecting non-contract addresses, requiring the candidate adapter to have granted SSP_ROUTER_ROLE to the router, and blocking adapter replacement once any vault is registered for that module.

Updates the adapter setup script and all tests to wire adapters first via adapter.setRouter(router) before calling setAdapter, and adds new router unit tests covering the new AdapterNotContract, AdapterReplacementBlocked, and AdapterNotWired reverts.

^{Reviewed by Cursor Bugbot for commit 70f3ec0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1f57e7d. Configure here.}