Fix #51: Add governance controls to set_config (code-hash pinning, multi-sig timelock, dispute window)

[funds0033-cmyk]

Closes #51

Problem

set_config applied changes immediately, with no verification that the passed-in contract addresses were legitimate WASM contracts, and no oversight process for changing critical config.

What landed

Config changes now go through a three-layer process instead of applying immediately:

1. Code-hash pinning — live WASM (and the XLM SAC) is read on-chain at proposal time. An EOA or a non-WASM contract passed as xlm_sac is rejected. Hashes are read again at execute time, so code can't be swapped during the delay window.
2. Multi-sig + timelock — a config change needs GovernorThreshold approvals and a 24h delay before execute_set_config can apply it.
3. Dispute window — cfg_req / cfg_ok / cfg_act / cfg_can events are emitted at each stage, and any governor can call cancel_set_config to block a pending change before it goes live.

Compatibility

initialize keeps the same 4-address ABI, so the rest of the suite should still compile. The initializer becomes the first 1-of-1 governor — production deployments should add governors and raise the threshold before relying on this.

Scope

This branch is off upstream/main and does not include the #57 work.

Branch: fix/issue-51-set-config-governance