fix(campaigns): guard withdraw_reserve against non-withdrawn campaigns (#443)

[mayborn005]

Summary

withdraw_reserve in src/campaigns/withdraw.rs loaded the Campaign, required the creator's auth, and released the reserve — but never asserted campaign.funds_withdrawn == true.

A CampaignReserve is only ever created inside withdraw_funds, after funds_withdrawn is set to true. So a reserve present on a non-withdrawn campaign represents an invariant violation (e.g. a reserve seeded through a future migration or an admin grant). Without this guard, such a reserve could be drained.

Fix

Add a defense-in-depth check right after the campaign is loaded, mirroring the existing is_verified re-check in withdraw_funds:

if !campaign.funds_withdrawn {
    return Err(Error::ValidationFailed);
}

Tests

Added test_withdraw_reserve_rejects_non_withdrawn_campaign, which seeds a CampaignReserve (release window already open) onto a campaign whose funds_withdrawn is still false and asserts withdraw_reserve returns Error::ValidationFailed.

Note: cargo test --features testutils currently fails to compile on main due to pre-existing, unrelated errors in src/admin.rs and src/lib.rs (DataKey/Symbol not in scope, Campaign.tags field missing). Those are outside the scope of this change — no error references the two files touched here.

Fixes #443

[drips-wave]

@mayborn005 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits