test(revenue_pool): keep pause guardian out of unpause and recovery (#1168)

[lienhoatienphung-svg]

Closes #1168

Summary

Adds explicit negative authorization and revocation tests proving that the lower-trust pause guardian role can activate pause and emergency_pause, but is strictly denied unpause, recover_from_emergency, and emergency drain entrypoints with RevenuePoolError::Unauthorized, and loses all pause rights once clear_pause_guardian is called.

Acceptance Criteria Mapping

• Guardian unpause fails with Unauthorized: Covered by guardian_can_pause_but_unpause_fails_with_unauthorized in contracts/revenue_pool/src/test_emergency.rs and guardian_denied_unpause_after_guardian_pause in contracts/revenue_pool/tests/emergency_auth_snap.rs.
• Guardian recovery fails with Unauthorized: Covered by guardian_can_enter_emergency_pause_but_only_admin_can_recover in contracts/revenue_pool/src/test_emergency.rs and guardian_denied_recover_from_emergency in contracts/revenue_pool/tests/emergency_auth_snap.rs.
• After clear_pause_guardian, guardian pause fails: Covered by cleared_guardian_cannot_pause_or_emergency_pause in contracts/revenue_pool/src/test_emergency.rs and guardian_denied_pause_after_clear_pause_guardian in contracts/revenue_pool/tests/emergency_auth_snap.rs.
• Auth snapshot file records guardian-denied entrypoints: Documented in the Guardian-Denied Entrypoints table and enforced by dedicated snapshot tests in contracts/revenue_pool/tests/emergency_auth_snap.rs.

Validation

• cargo test -p callora-revenue-pool guardian

---

Payout Wallet (Base Mainnet USDC / EVM): 0x3806cd592a508d1992Ed007C2F53de251C2E7452