fix(contracts): reject invalid Safe nonce overrides

[Lesnak1]

Summary

• Follow the documented nonce override precedence: address-specific variable (SAFE_NONCE_{ADDRESS}), then general override (SAFE_NONCE), then fallback to on-chain Safe nonce.
• Distinguish an unset override from a malformed configured value using vm.envExists so invalid parsing errors revert as expected rather than being silently ignored.
• Add regression coverage in test/universal/MultisigScript.t.sol covering Safe nonce fallback, general override, address-specific precedence, and revert on malformed override values. The test uses an isolated Safe mock and cleans up environment variables after execution.

Fixes #443.

Validation

• Formatting & Linting: forge fmt --check and git diff --check pass cleanly with zero whitespace or formatting issues.
• Semgrep: Preserved repository safety guidelines with // nosemgrep: sol-safety-expectrevert-no-args.
• Regression Suite: Added test_getNonce_envOverrides_followDocumentedPrecedence to comprehensively verify all documented override and fallback paths.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1