[Quality][High] Prove solvency across all escrow and fee buckets

[Baskarayelu]

Objective

Define a global solvency invariant and make it executable in tests and diagnostic paths.

Why this matters

The protocol holds funds across escrow, fees, refunds, and defaults. A local balance check may miss value stranded in one bucket or counted twice.

This is a substantive production-quality improvement. It must change runtime behavior, security guarantees, correctness, reliability, or meaningful user functionality. It is not a documentation-only, formatting-only, or trivial dependency task.

Scope

Area: solvency invariants

Starting points: src/invariants.rs, src/payments.rs, src/settlement.rs, src/profits.rs

The contributor should verify the current implementation before changing it and keep the PR limited to this issue. Do not introduce unrelated refactors or weaken existing CI/security gates.

Acceptance criteria

• The invariant accounts for every token balance and protocol liability.
• Successful lifecycle operations preserve conservation.
• Failed operations do not change the invariant.
• Diagnostic output identifies the bucket and record responsible for any mismatch without leaking secrets.

Required validation

• Add randomized lifecycle sequences and check solvency after every step.

• Test cancellation, refund, default, fee, and failed-transfer branches.

• Add a deliberately corrupted fixture proving the diagnostic catches drift.

• The PR explains the failure mode, the chosen design, backward-compatibility impact, and rollback or migration considerations.

• The PR includes CI evidence and does not contain secrets, generated noise, unrelated cleanup, or disabled checks.

Contributor deliverables

• Open a focused feature branch and do not begin implementation until assigned.
• Reference this issue with Closes #<issue-number> or Fixes #<issue-number>.
• Check off every acceptance criterion in the PR with links to the relevant code and tests.
• Include a security/correctness note explaining why adversarial inputs cannot bypass the new guarantee.

Maintainer quality bar

The PR must be independently reviewable, preserve existing behavior outside this scope, exercise failure paths, and pass the repository's complete required CI/CD checks. Reward eligibility is not guaranteed by this issue or by merging.