[contracts] v2 design: multisig gateway oracle set (PRD OQ3, deferred)

[yinkscss]

Context

PRD defaults to single authorized gateway address (OQ3). Roadmap Phase 3 mitigation notes multisig oracle as v2.

Problem

Centralization risk of single gateway key needs a documented upgrade path without implementing it in v1.

Proposed scope

• Add docs/future/multisig-oracle.md describing M-of-N attestation model
• Sketch contract changes (record_merge auth vector, threshold)
• Document operational requirements for Wave program operators

Acceptance criteria

• Design doc references current initialize gateway param
• Explicitly deferred from v1 contract changes
• Lists breaking changes for deployers

References

• docs/PRD.md OQ3, technical constraints
• contracts/waveflow-escrow/src/contract.rs (initialize, record_merge)
• docs/ROADMAP.md risk register