feat(soroban): owner-gated upgradeability for PredicateRegistry

[alex-predicate]

Summary

Makes the deployed PredicateRegistry Soroban contract upgradeable in place using Soroban's native upgrade mechanism (update_current_contract_wasm) — same contract address, storage preserved, bytecode swapped. No proxy pattern needed.

Scope is the registry only. predicate-client is a library linked into consumers, so there is nothing there to upgrade independently; consumer/token contracts are unchanged.

Changes

• upgrade(owner, new_wasm_hash) on PredicateRegistryContract, gated by the existing require_owner helper (owner check + require_auth). Non-owner calls revert with RegistryError::Unauthorized (v1.0.2 #1). Emits an upgrade event with the new WASM hash, following the existing event convention. No new storage keys, no version counter (the ledger already records the WASM hash).
• Self-upgrade test (test_upgrade_happy_path_preserves_storage): uploads the crate's own compiled WASM, upgrades to it, and asserts owner + a registered attester survive the swap — proving the upgrade path and storage preservation. Plus test_non_owner_cannot_upgrade for the auth gate.
• scripts/upgrade-registry.sh: builds → stellar contract upload → invokes upgrade on an existing registry, mirroring deploy-registry.sh.
• CI: soroban-build now installs the wasm32v1-none target and builds that artifact before cargo test, because the self-upgrade test contractimport!s it at compile time.

Build-target note

Both the test and the ops script build with stellar contract build / wasm32v1-none, not cargo build --target wasm32-unknown-unknown — the latter emits reference-types WASM that the Soroban host rejects at upload (reference-types not enabled).

Upgrade discipline

Because storage survives the bytecode swap, future registry WASM must remain compatible with the existing storage schema (owner, pending owner, attesters, policies, spent UUIDs). Adding keys is safe; changing an existing key's type/meaning requires an explicit migration.

Testing

cargo test — 39 tests pass across the workspace (21 in predicate-registry, including both new upgrade tests). Reviewed via subagent-driven review per task plus a whole-branch review; the one Critical found (CI missing the wasm32v1-none build) is fixed in this branch.

🤖 Generated with Claude Code