fix(oracle): reject impossible result times

[rndrntwrk]

Summary

Fixes the DuelOutcomeOracle result-timeline validation finding from the contract audit.

proposeResult() and reproposeResult() now reject impossible result timestamps:

• result end before betCloseTs
• result end before duelStartTs
• result end in the future relative to block.timestamp

The fix is intentionally local to DuelOutcomeOracle; affected tests were updated to resolve duels at a valid result timestamp instead of relying on future duelEndTs values.

Security Impact

Before this change, an authorized reporter could submit a result before the duel was scheduled to start, or with a future result timestamp. That could make downstream settlement consumers treat an impossible timeline as oracle truth.

After this change, oracle result submission fails closed unless the reported result time is inside the valid historical duel window.

Validation

• Reproduced the issue first with four failing regression tests:
  • test_proposeRejectsResultBeforeDuelStart
  • test_proposeRejectsFutureResultEnd
  • test_reproposeRejectsResultBeforeDuelStart
  • test_reproposeRejectsFutureResultEnd
• forge test --match-path test/OracleFinality.t.sol -> 27 passed
• forge test -> 178 passed, 0 failed
• forge build -> pass
• git diff --check -> pass

forge fmt --check remains noisy on pre-existing project style drift, so this PR does not apply broad formatting churn.

Rollout

Draft PR for review. This branch targets main; the same commit is intended to be replayed into enoomian/staging for staging deployment/testing without making enoomian/staging the long-term merge target.