security(vault): add reentrancy protections and callback-safe transfer sequencing

[rosspeili]

Labels (manual)

enhancement

Summary

Harden vault execution against callback-based attacks.

Why

Reentrancy risk is explicitly identified in trust-boundary docs.

Scope

• Add reentrancy protection strategy
• Ensure checks-effects-interactions sequencing
• Add malicious receiver test contracts

Acceptance Criteria

• Reentrancy attack tests fail (protected)
• Sequencing assumptions are documented