feat: add mainnet role validation script for attestation contract

[lauferuqquyah]

Summary

Adds a post-deployment validation script for the attestation contract that
asserts privileged roles and governance bindings are set, so an ownerless or
half-configured contract cannot silently go live on mainnet.

Closes #448.

What changed

• scripts/validate_mainnet_roles.sh — queries a deployed contract via
  stellar contract invoke and runs five checks, printing a consolidated
  report and exiting non-zero if any binding is missing.
• scripts/test_validate_mainnet_roles.sh — offline test suite that stubs
  the stellar CLI and drives each check through its pass and fail paths.

Checks performed

1. ROLE coverage — parses every ROLE_* constant from access_control.rs
   and confirms the validator accounts for each, so a newly added role can't
   slip through unchecked.
2. Admin bound — get_admin() returns a real, non-null address.
3. Admin quorum — get_admin_quorum_weight() is greater than zero.
4. Multisig — get_multisig_owners() is non-empty and
   1 <= get_multisig_threshold() <= owner count.
5. DAO wiring — get_pending_dao_rotation() is None (no dangling rotation
   on a fresh deploy).

Any failure exits non-zero, suitable for gating a deployment pipeline.

Known limitation

The contract exposes no read-only getter for the active DAO controller
address (only set_dao, the rotation methods, and
get_pending_dao_rotation). The script therefore cannot assert the active
DAO address directly; it validates the absence of a pending rotation and
documents this gap. Fully closing it would require exposing a get_dao()
view on the contract.

Testing

bash scripts/test_validate_mainnet_roles.sh runs entirely offline (the
stellar CLI is replaced by a stub) and exercises all five checks plus each
failure path: null/malformed admin, zero quorum, empty multisig, threshold
exceeding owner count, and a pending DAO rotation. All 12 assertions pass.

closes#448

[drips-wave]

@lauferuqquyah Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits