fix: lock error codes, refresh toolchain drift, add scanner emergency pause

[devin-ai-integration]

Why

A rigorous scan of the workspace surfaced several correctness and consistency issues that should land before any further on-chain work. The headline item is a silent error-code numbering bug in GraveVault that would have broken every downstream consumer (indexer parsers, SDK error matchers, IDL clients). The rest is governance/operations gaps, a CI install bug that masked the anchor build step on main, and toolchain documentation drift.

What

• GraveVault: error codes now match the documented 7000..=7014 range. Anchor's #[error_code] macro applies a default +6000 offset on top of every Rust discriminant. With the previous Unauthorized = 7000, ... discriminants, the on-chain values emitted were actually 13000..=13014 — silently wrong. Fix overrides the offset (#[error_code(offset = 7000)]) and renumbers discriminants to 0..=14. A new unit test in both programs/grave-scanner/src/errors.rs and programs/grave-vault/src/errors.rs locks the on-chain numbering against future drift.
• GraveScanner: add emergency_pause instruction. ProtocolConfig.paused was checked inside evaluate_pool_phase_1 / _phase_2 but no instruction could set it — the kill switch was unreachable. New instruction is multisig-only, immediate, and emits ProtocolPauseChanged. Mirrors GraveVault's emergency_pause. update_protocol_config also gains lp_burn_dust_threshold as a tunable parameter (the field's doc-comment said it was governance-tunable but the handler never touched it).
• SDK: priorityFee.ts no longer truncates BN inputs. computeOperationalMaxLamportsPerCu was calling BN.toNumber() on lamport amounts, which throws for values above Number.MAX_SAFE_INTEGER (~9.0e15) — well within reach for realistic Solana profits. Math now runs in pure BN via a 10_000-bps integer quantisation of marginRatio, plus tighter input validation (rejects NaN, negative profit).
• CI: anchor build was reliably broken on main. cargo binstall --no-confirm anchor-cli was reporting "already installed" from Swatinem/rust-cache-restored ~/.cargo/.crates2.json while ~/.cargo/bin/anchor was missing, so the subsequent build step crashed with command not found (exit 127). Add --force to binstall so it always installs the binary regardless of cached metadata. Verified the same failure exists on main (e.g. run 25846568599) — so this commit fixes a preexisting CI bug, not one introduced by this PR.
• Toolchain drift: README.md, CONTRIBUTING.md, scripts/check-toolchain.sh, .github/dependabot.yml, and inline comments in both program crates were still citing the pre-3.x stack (Solana 2.0.x / Anchor 0.31.x / Rust 1.79+ / Node 20 LTS) while Anchor.toml, rust-toolchain.toml, and package.json had already moved to Solana 3.0.10 / Anchor 0.32.1 / Rust 1.91.1 / Node 24 LTS. Aligned everything; check-toolchain.sh now passes locally with the actual stack. Also bumps Cargo.lock to track anchor-attribute-* = 0.32.1 (the workspace was on 0.32.1 in Cargo.toml but the lockfile had stale 0.31.1 entries).

Risk

• Charter invariants touched: None. The 20% ceiling, lp_holder_pool_vault unsweepability, and 72h timelock are all unchanged. The new emergency_pause follows the same Charter framing as GraveVault's ("Emergency pause is immediate") and is multisig-only.
• Migration required: No on-chain migration. The GraveVault error-code fix is pre-mainnet — there are no deployed instances whose IDL or stored discriminants need to be migrated. UpdateProtocolConfigParams gains a new Option<u64> field (lp_burn_dust_threshold), so existing serialized payloads need to be regenerated by clients before being re-submitted — also a non-issue pre-mainnet.
• Audit surface: New emergency_pause instruction on GraveScanner (same accounts shape as GraveVault's equivalent, no CPIs, single bool write + event emit). New optional parameter in update_protocol_config. Error-code numbering reshuffled for GraveVault (variants and #[msg] strings unchanged; only on-chain discriminants change). No new accounts, no new PDAs, no new CPIs.

Tests

• cargo fmt --all -- --check (CI green)
• cargo clippy --all-targets -- -D warnings (CI green)
• anchor build (CI green — see the CI fix above)
• pnpm -r typecheck (CI green)
• anchor test (no integration tests exist yet per tests/README.md)
• bash scripts/terminology-lint.sh (CI green)
• cargo test --workspace --lib — 22 tests pass (20 existing + 2 new on_chain_codes_match_docs)
• Hand-validated computeOperationalMaxLamportsPerCu against the old buggy BN.toNumber() overflow path and against ceiling-clamp / margin=0 / NaN / negative-profit edge cases

Checklist

• Commits are signed (git commit -S). (Signing key not configured in this environment; verify on merge or sign locally.)
• Branch follows feat/, fix/, chore/, or docs/ prefix. (devin/<ts>-rigorous-bug-scan-fixes per the repo's session-naming convention.)
• Conventional Commit messages.
• Spec changes are reflected in docs/ in the same PR. (docs/error_codes.md already documented 7000..=7014 — the code now matches; toolchain docs in README/CONTRIBUTING aligned to the actual pinned stack.)
• Canonical v4.0 terminology only — terminology lint passes.

Link to Devin session: https://app.devin.ai/sessions/73cd25de45e649ac9e00ac72d759492d
Requested by: @graveyieldprotocol

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring