fix: validate account count and enforce payer mutability

[L0STE]

Context

The dispatch! macro and __handle_event both skip the num_accounts u64 at the start of the SVM input buffer without ever reading it. If a transaction provides fewer accounts than the instruction expects, parse_accounts walks past the valid account data into unmapped memory and the SBF VM traps with an access violation. Not a security vulnerability (the crash is safe — no state changes, no fund loss), but a correctness issue: programs should return NotEnoughAccountKeys instead of crashing.

Separately, there was no compile-time enforcement that payer accounts are writable. The Solana runtime catches this at execution time, but a build error is strictly better than a failed transaction on testnet.

Ref: #80 (QSR-01, QSR-04, QSR-05). QSR-02 is a compile-time-only footgun, QSR-03 is wrong (intentional SIMD-0321 entrypoint).

Changes

lang/src/entrypoint.rs — Read num_accounts from offset 0 of the SVM buffer. Each dispatch! match arm now checks num_accounts >= COUNT before calling parse_accounts. ~2 CU cost.

derive/src/program.rs — __handle_event checks num_accounts > 0 before dereferencing the first account for the event authority signer/address check.

derive/src/accounts/fields.rs — process_fields now rejects at compile time if the init or realloc payer field is not &mut or #[account(mut)].

Test plan

• cargo check — clean
• cargo fmt — clean
• cargo clippy — clean
• Full test suite — 729 passed, 0 failed

[github-actions]

⚡ CU Benchmark (Vault)

Instruction	Base	PR	Delta
Deposit	1,575	1,577	+2 🔴
Withdraw	409	411	+2 🔴

Binary size: 6,928 bytes (+40 🔴 bytes)