test(settlement): pin admin-set guard on empty and duplicate recovery targets

[BigManly4]

closes #582

Problem

execute_recovery writes DataKey::Admin directly rather than going through validate_admins_and_threshold, and the existing suite in settlement_contract/src/tests/admin_tests.rs only exercised the recovery happy path (recovery_executes_after_delay). Nothing asserted:

• that the admin set execute_recovery installs is non-empty and duplicate-free,
• that validate_admins_and_threshold actually rejects an empty or duplicate admin set, and
• that a duplicate recovery/transfer target is rejected rather than silently accepted.

Changes

Added settlement_contract/src/tests/recovery_admin_set_tests.rs and wired it into settlement_contract/src/tests/mod.rs.

validate_admins_and_threshold — the guard itself

• validate_rejects_empty_admin_set_with_threshold_one / ..._with_zero_threshold — empty admin vector is rejected with InvalidThreshold (Fix Settlement Rule Validation (Sum Limit) #26).
• validate_rejects_duplicate_admins, validate_rejects_duplicate_admins_at_threshold_one, validate_rejects_non_adjacent_duplicate_admins — the duplicate-target test called out in the issue, covering adjacent and non-adjacent duplicates at threshold 1 and 2, all rejected with InvalidAdmin (Custom Error for Admin Authorization Failure #14).
• validate_rejects_zero_address_in_admin_set — a zero-address entry anywhere in the set is rejected with ZeroAddress (Audit Event Publishing Payload in remove_anchor #21).
• validate_accepts_distinct_admin_set — a legitimate distinct set is accepted (negative control).

Post-recovery admin set

• recovery_settles_on_non_empty_single_admin_set — after initiate_recovery + execute_recovery, get_admin() holds exactly one address, get_threshold() is 1, and the resulting set passes validate_admins_and_threshold — pinning that recovery can never settle on an empty set.
• recovery_to_existing_admin_does_not_duplicate_admin_set — recovering to an address that is already in the admin set collapses to a single entry rather than storing it twice.
• initiate_recovery_rejects_zero_address_target — an invalid recovery target is rejected before it can ever reach the pending-recovery record.

transfer_admin from the recovered admin

• recovered_admin_cannot_transfer_to_empty_admin_set — the freshly recovered lone admin cannot transfer to an empty set (InvalidThreshold, Fix Settlement Rule Validation (Sum Limit) #26).
• recovered_admin_cannot_transfer_to_duplicate_admin_set — nor to a set with a duplicated target (InvalidAdmin, Custom Error for Admin Authorization Failure #14).
• rejected_duplicate_transfer_leaves_recovered_admin_set_intact — uses try_transfer_admin to confirm both rejections leave get_admin()/get_threshold() untouched.

Testing

• cargo test --workspace — all 62 tests pass (33 governance + 29 settlement, including the 12 new tests here).
• cargo fmt --all -- --check — clean.
• cargo clippy --all-targets -- -D warnings — clean.

This is test-only; no production code changes.

[therealjhay]

Kindly resolve conflict