fix: validate Blend adapter constructor addresses

[carrion256]

Fixed Findings

• A-060 / Nexus 6a5a3ec7-5477-4c2f-9488-30308ab956d6

Summary

• Reject non-contract admin, vault, and pool addresses during Blend adapter construction.
• Keep the constructor atomic; invalid deployment inputs now fail before config is persisted.
• Update unit and integration fixtures to use real contract addresses for constructor roles.

Root Cause

The Blend adapter constructor accepted raw Address values and stored them without checking that deployment-bound authorities and dependencies were contract addresses. That allowed account-form addresses to be persisted for the admin/vault/pool configuration even though the adapter's runtime boundary expects contract-address dependencies.

Verification

RED:

cargo test -p templar-soroban-blend-adapter constructor_rejects_non_contract -- --nocapture
# before fix: 0 passed; 3 failed
# each failure: test did not panic as expected

GREEN:

cargo test -p templar-soroban-blend-adapter constructor_rejects_non_contract -- --nocapture
# after fix: 3 passed; 0 failed

cargo test -p templar-soroban-blend-adapter -- --nocapture
# 15 unit tests passed; 7 integration tests passed

cargo fmt --check
# passed

git diff --check
# passed

Stack

Base: audit/adapter-admin-retarget-a035 / PR #438.

---

This change is 

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 477b7c7f-d377-452a-b087-fca9cc559611

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch audit/adapter-constructor-a060

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[carrion256]

Superseded by #431, which consolidates the tracker-defined adapter-accounting-and-blend-admin boundary for A-032/A-033/A-034/A-035/A-060. Closing this split draft so auditors have one adapter follow-up PR to review.

[carrion256]

Closed as superseded by #431 consolidated adapter-accounting-and-blend-admin PR.