feat(escrow): security hardening — side-channel padding (#284), commit-reveal trade IDs (#281), anti-spam bonding (#280)

[Adebisi1111]

Summary

Security hardening for the escrow contract on the three assigned Grantfox issues. The three fixes are coupled (shared `DataKey` variants and helpers in one contract file), so they are delivered together for a single coherent review.

#284 — Side-channel via per-branch resource metering

• flatten_branch_cost() touches a fixed synthetic instance-storage key at the entry of lock/release/refund, so the contract emits a uniform instruction budget regardless of settled-vs-live branch (removes the leak where settled vs. unsettled escrows cost differently).
• Companion analysis doc: docs/side-channel-resource-metering.md (branch-cost delta, leak of live-vs-settled state, mitigation recommendation).
• Test cost_side_channel asserts branch costs are within tolerance using env.budget().instructions().

#281 — Adversarial trade-ID choice

• commit_trade_id(caller, commit) lets a caller commit to sha256(id || salt) before revealing; reveal_and_lock(...) reveals and only proceeds if the commit is unexpired and matches. This prevents a caller from choosing a trade ID after observing peer state.
• lock() refactored to delegate to a shared create_trade(...) helper so both the direct and commit-reveal paths share identical trade-creation logic.
• Test issue281_commit_reveal covers happy path + adversarial choice rejection.

#280 — Contract-level spam / griefing

• set_bond_config(...) (multisig-gated, reuses existing require_multisig) configures a refundable bond.
• Unestablished callers (reputation < threshold) post a refundable bond in create_trade; bond is refunded and reputation bumped on release/refund via complete_with_bond_refund. Dust-proof + game-resistant ("established" = reputation >= 3 AND amount >= MIN_ESTABLISH_AMOUNT).
• get_reputation / get_bond public views; issue280_bonding test covers the full flow.

Test plan

• cd contracts && cargo test -p escrow
• cargo build --target wasm32-unknown-unknown -p escrow (wasm artifact)

Note: local cargo test could not be executed on the build box (no C linker / corrupted GNU toolchain); CI validation is expected to run these. Code follows the repo's existing Env::crypto().sha256 / panic_with_error patterns exactly.

Closes

Closes #284
Closes #281
Closes #280

[vercel]

Someone is attempting to deploy a commit to the jotelfootball-tech's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Adebisi1111]

Superseded by 3 issue-specific PRs (per the request for separate PRs):

• feat(escrow): #281 commit-reveal trade-ID hardening #292 — #281 commit-reveal trade-ID hardening
• feat(escrow): #280 contract-level anti-spam bonding #293 — Contract-enforced anti-spam bonding, independent of the API layer #280 contract-level anti-spam bonding
• feat(escrow): #284 side-channel resource-metering mitigation #294 — Side-channel analysis of transaction resource metering #284 side-channel resource-metering mitigation

This combined PR also contained leftover git conflict markers from a bad merge and is being replaced by the clean, per-issue branches above.