PR-A: reviewer remediation (S-02 v2, S-08, S-10) + PoC suite

[VSP-0]

PR-A — independent security review remediation (vs freeze 58971c05)

Applies the three verified remediation patches delivered by the independent
reviewer (@ibnu76, engagement letter 2026-08-25, report 2026-08-24) and carries
his 26 proof-of-concept / adversarial test files into the suite.

Findings fixed

Finding	Severity	Fix
S-02 — a fully-exited "ghost" lot (amount == 0) retained its queue index; a 1-wei pre-stake let an address buy the earliest reward-queue position, a zero-sum misroute of ~51.84e18 from honest stakers in the PoC scenario	Medium	v2: on re-entry over a ghost, the ghost is removed via an order-preserving shift-compact (lot indices rewritten), then the address re-enters through the normal new-staker routing — ghost re-entry is now byte-identical in outcome to fresh entry
S-08 — compactLots used reverse swap-and-pop, silently promoting the last staker into the removed slot at another honest staker's expense	Low	single forward read/write compaction pass; survivors keep arrival order
S-10 — view projections divided by decay-projected sMax while settlement (_forceSnapshot) divides by raw sMax, breaking V.8 (view == materialised) whenever the decay fallback is live	Informational	both view sites now read raw sMax, matching settlement

The reviewer's superseded S-02 v1 patch (passes the green baseline but
orphans 500e18 of user funds — the concrete proof that a green baseline does
not validate a fix) is not applied; it is retained as a record in the
artifacts archive, and S02FixOrphanCheckPoC.t.sol is the regression test
that catches it.

Test suite

26 reviewer test files added (PoCs, validation, adversarial regression, scope
coverage, Z3-backed closures for S-06/S-07/S-04). Two demonstration-form PoCs
(test_S02_Differential, test_S02_RealToken) asserted the presence of the
S-02 advantage and were converted to regression form (marker
patch_prA_s02_regression): they now assert ghost-scenario ≡ fresh-scenario
exactly. Originals preserved unmodified in the artifacts archive.

Verification (reproduced independently before this PR)

• Artifacts: per-file sha256sum -c CHECKSUMS.sha256 — 33/33 OK
• Pristine src/StakeEngine.sol sha256 7beaca7f… matches the reviewer's manifest
• Each patch applied alone: post-patch sha256 matches the manifest table
  byte-for-byte; finding's PoC flips; 232 baseline stays green
• Unpatched tree + PoCs: 325 total / 324 pass / 1 fail (the deliberate S-10 red) — matches manifest prediction exactly
• This branch (all three + regression-form PoCs): 325 passed / 0 failed,
  forge fmt --check clean, slither gate GREEN (89 baseline fingerprints, no
  new findings)
• Combined src/StakeEngine.sol sha256:
  a0f5bfdbeee955c951930dbda30a76040136bf047973a00221ecb2433a746490

Notes

• Gas: the S-02 ghost-removal path worst-case shifts O(MAX_RANKED_LOTS = 100)
  lots; it runs only on the rare ghost-re-entry branch.
• Interaction to watch: PR-C's S-03 work touches sMax descent mechanics;
  S10ValidationPoC stays in the suite as the V.8 guard.
• Pre-genesis: no storage-layout constraints apply; the fresh Fuji redeploy is
  sequenced with PR-C per SESSION-STATE.