Protocol hardening: make governance and DEX authority reachable and bound EndBlock work (TRR-06 through TRR-08)

[NeaBouli]

Parent audit register: #303
Rollout tracker: #29
Findings: TRR-06, TRR-07 and TRR-08.

Acceptance criteria

• Define and test how the reserved governance domain is anchored with an explicit electorate on every supported genesis path.
• Replace the unspendable DEX module-account signer boundary with an approved governance adapter, or explicitly freeze the registry at genesis.
• Bound domain, member, issue, suggestion and text growth relevant to consensus work.
• Replace or schedule full-domain EndBlock scans so work is deterministic and bounded.
• Add adversarial scale, gas/time budget, genesis/export/import, upgrade and recovery tests.
• Document the consensus version and migration requirements before implementation.

Safety boundary

No migration, IBC client change, deployment or production activation.