fix(security): enforce release-safe leaf canonicalization and mining reward quantum alignment

[mertcano]

Description

Remediates load-bearing security invariants in pallet-zk-tree and pallet-mining-rewards that were previously enforced only via debug_assert! and compiled out of production (--release) builds.

Key Changes & Remediations

• Structural Leaf-Recipient Canonicalization (chain/pallets/zk-tree/src/tree.rs):

  • Replaced the debug-only assertion in hash_leaf with in-place canonicalization via canonicalize_account_bytes() across all build profiles[cite: 70, 71].
  • Ensures non-canonical 8-byte limbs (>= GOLDILOCKS_P) are reduced modulo P before felt encoding, eliminating non-injective leaf aliasing and preventing shared nullifier lockups in the zk-wormhole[cite: 70, 71].
  • Preserved fallback handling for non-32-byte account implementations to avoid runtime panics[cite: 70, 71].

• Release-Enforced Quantum Alignment & Zero-Division Guard (chain/pallets/mining-rewards/src/lib.rs):

  • Hardened quantize() to return (zero, amount) when leaf_quantum() is zero, preventing potential divide-by-zero panics inside the critical on_finalize consensus hook[cite: 70, 72].
  • Re-derived quantum alignment directly inside mint_reward(), ensuring only multiples of AMOUNT_SCALE_DOWN_FACTOR are minted into circulation while retaining sub-quantum dust in CollectedFees across all build targets[cite: 70, 72].

Verification

• Verified byte-compatibility of canonicalize_account_bytes with existing lossy encoding paths[cite: 70, 71].
• Confirmed zero-quantum edge cases return cleanly without triggering integer division panics[cite: 70, 72].
• Validated no changes to public input layouts, storage keys, or honest issuance mechanics[cite: 70].