fix: reorder UtxoOwners writes to prevent inconsistent persistence (PM-20218)

[m2ux]

Summary

Add test coverage for the event construction failure path in the NTO pallet's handle_create, verifying that UtxoOwners is not modified when construct_cnight_generates_dust_event fails. This addresses the remaining acceptance criterion for audit finding Issue I (PM-20218).

🎫 PM-20218

---

Motivation

The core fix for audit finding Issue I (UtxoOwners persist inconsistently in handle_create) has already been merged — UtxoOwners::insert now occurs inside the Ok arm of the event construction match. However, acceptance criterion #5 ("new tests cover the event construction failure path") has not been addressed. Without this test, there is no automated verification that a regression would be caught if the operation ordering were inadvertently reverted.

---

Changes

Implementation (coming next):

• Add test asset_create_with_invalid_dust_key_should_not_insert_utxo_owner — registers a wallet with invalid DustPublicKeyBytes, submits AssetCreate, verifies UtxoOwners is empty and no SystemTransactionApplied event emitted
• Add test asset_spend_without_create_should_not_emit_destroy_event — verifies handle_spend guards against Destroy events for UTXOs without prior Create
• Verify all existing tests pass

---

🗹 TODO before merging

• Ready

📌 Submission Checklist

• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason: test-only changes
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• Updated AGENTS.md if build commands, architecture, or workflows changed
• No new todos introduced

🧪 Testing Evidence

Please describe any additional testing aside from CI:

• Additional tests are provided (if possible)

🔱 Fork Strategy

• Node Runtime Update
• Node Client Update
• Other
• N/A

Links

• Jira: https://shielded.atlassian.net/browse/PM-20218
• Parent Epic: https://shielded.atlassian.net/browse/PM-19974
• Reference: Least Authority - Shielded Midnight Network Node Initial Audit Report (October 24, 2025), Issue I

[github-actions]

KICS version: v2.1.16

Category Results CRITICAL 0 HIGH 0 MEDIUM 96 LOW 12 INFO 83 TRACE 0 TOTAL 191	Metric Values Files scanned 31 Files parsed 31 Files failed to scan 0 Total executed queries 73 Queries failed to execute 0 Execution time 8