Add two-step admin handoff (propose/accept) to set_admin across stateful crates

[1nonlypiece]

📌 Description

set_admin in commitment_nft (line ~577), attestation_engine (line ~503),
allocation_logic (line ~748), and price_oracle (line ~355) performs a one-step
admin transfer. A typo'd or compromised target address irreversibly bricks admin
control of fund-custodial contracts. The standard mitigation is a two-step
propose/accept handoff.

This issue introduces a two-step admin transfer for these crates.

🎯 Requirements and Context

• Add propose_admin(new_admin) (current-admin-gated) storing a PendingAdmin, and accept_admin() (callable only by the pending admin).
• The transfer only completes after accept_admin; a re-propose overwrites the pending value.
• Preserve the existing set_admin callers or deprecate it consistently across the four crates.
• No regressions to other admin-gated functions.

🛠️ Suggested Execution

1. Fork the repo and create a branch

git checkout -b security/two-step-admin

2. Implement changes

• Add PendingAdmin keys and propose_admin/accept_admin to each crate's lib.rs with /// docs.
• Document the handoff in docs/SECURITY_CONSIDERATIONS.md and docs/TIMELOCK_RUNBOOK.md.

3. Test and commit

• Add tests to each crate's tests.rs.
• Run: cargo test --target wasm32v1-none --release
• Edge cases: propose then accept, accept by wrong address rejected, re-propose overwrites, non-admin propose rejected.

Example commit message

fix: two-step admin handoff across stateful contracts

✅ Guidelines

• Minimum 95% test coverage on the handoff paths.
• Document the procedure.
• Timeframe: 96 hours.

🏷️ Labels

type-security · area-contracts · MAYBE REWARDED · GRANTFOX OSS · OFFICIAL CAMPAIGN

💬 Community & Support

• Join the CommitLabs contributor Discord to coordinate and get unblocked fast: https://discord.gg/WV7tdYkJk
• Introduce yourself before starting to avoid duplicate work.
• Maintainers triage actively and review fast.

[dangelo352]

I'll take this one. I will add PendingAdmin plus propose_admin/accept_admin to commitment_nft, attestation_engine, allocation_logic, and price_oracle; keep set_admin as a deprecated proposal wrapper so existing callers compile without one-step transfer; add wrong-accept/reproposal/non-admin coverage; and document the handoff runbook.

[OmniZlatoon]

Good day sir, I have 5 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

[grantfox-oss]

🦊 GrantFox — @dangelo352 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #492)
2. Your PR will be reviewed by the Commitlabs-Org maintainers

Good luck! Track your progress on GrantFox.

[1nonlypiece]

You're in! This one's yours now. For support, questions, or just to chat with other contributors, join us on Discord: https://discord.gg/jzgTqSbZX