[Testing] Add adversarial and negative tests for fund-safety, auth, and the dispute flow

[david87131]

Why this matters

Critical paths are untested or commented out. dispute_resolution/src/tests.rs has its entire core flow commented out behind a missing mock even though a MockChiomaContract is defined. escrow has no test for non-party release, double-release/refund, or cross-escrow isolation. agent_registry has no test that register/complete require auth, and the chioma contract has no test for cross-token payment mismatch or full-balance escrow release. The absent negative tests are exactly why the auth and fund-safety bugs went unnoticed.

Acceptance criteria

• dispute_resolution core-flow tests are uncommented and pass against the existing MockChiomaContract
• escrow gains tests for non-party release rejection, no double-release after refund, escrow isolation, and deduction redirect prevention
• agent_registry gains tests asserting register/complete/rate reject unauthorized callers and self-rating
• The chioma contract gains tests for cross-token payment unit consistency and that release does not sweep the whole balance

Files to touch

• contracts/dispute_resolution/src/tests.rs
• contracts/escrow/src/tests.rs
• contracts/agent_registry/src/tests.rs
• contracts/chioma/src/tests_multi_token.rs

Out of scope

• Setting up CI to run the suite
• Fuzz/property-based harness

[david87131]

Superseded by the consolidated contract audit issues (#67-#104) which cover the same findings more comprehensively. Closing to avoid duplicate coverage.

[OmniZlatoon]

Hi maintainer sir, I'm called Junior Brown , a full-stack and smart contract engineer building on Stellar. I specialize in designing and shipping scalable, secure systems end-to-end, from Soroban smart contracts to production-ready backend infrastructure and user-facing applications.