audit: implement LEP-6 heal-op lifecycle and recheck handlers

[j-rafique]

Summary

This PR implements LEP-6 PR4 (heal-op lifecycle) in lumera: on-chain heal operation transitions, verifier-driven finalization, and epoch-end expiration/scheduling for self-heal ops.
The rollout remains non-breaking and keeps deferred LEP-6 enforcement behavior out of scope.

What’s Implemented

1) Heal-op tx lifecycle

Added/implemented keeper logic for:

• MsgClaimHealComplete
• MsgSubmitHealVerification
• MsgSubmitStorageRecheckEvidence (validated + wired, intentionally gated as not active in this milestone)

Behavior:

• Strict request validation and signer/role authorization
• Status transitions:
  • SCHEDULED / IN_PROGRESS -> HEALER_REPORTED
  • HEALER_REPORTED -> VERIFIED (all required positives) or FAILED (any negative)
• Single-node finalize path (no verifiers) with immediate completion
• Ticket linkage updates on finalize (active_heal_op_id cleared; verified path updates probation/last-heal fields)
• Event emission for healer reported / verified / failed

2) Epoch-end heal-op processing

Implemented epoch-end lifecycle execution:

• Expire overdue non-final heal ops (deadline_epoch_id <= current_epoch)
• Clear stale active heal-op pointers from ticket deterioration state
• Schedule new heal ops from deterioration candidates by priority:
  • threshold/probation filtering
  • max-per-epoch cap
  • deterministic participant selection (healer + verifiers)
  • deterministic tie-breaking and ID progression

3) State model integration

Integrated with existing LEP-6 storage-truth state surfaces:

• HealOp + status/ticket indexes
• verifier submissions keyed by (heal_op_id, verifier)
• ticket deterioration state linkage/counters used by lifecycle transitions

Out of Scope (Deferred)

• Recheck evidence activation logic (kept gated for later milestone)
• Enforcement/penalty activation (PR5 scope)

Key Files

• x/audit/v1/keeper/msg_storage_truth.go
• x/audit/v1/keeper/storage_truth_heal_ops.go
• x/audit/v1/keeper/abci.go
• x/audit/v1/keeper/msg_storage_truth_test.go
• x/audit/v1/keeper/storage_truth_heal_ops_test.go

Testing

Added/updated tests for:

• tx validation + authorization paths
• healer claim / verifier submission flows
• verified and failed finalize branches
• single-node immediate finalize
• epoch-end expiration + scheduling behavior
• ticket state linkage updates

Validation run:

• go test ./x/audit/v1/... -count=1

[roomote-v0]

Rooviewer   See task

All 3 previously flagged issues have been addressed in aead156. No new issues found.

• Bug: ClaimHealComplete double-appends req.Details to healOp.Notes in the zero-verifier (single-node) path -- once before calling finalizeHealOp and once inside it
• Cleanup: finalizeHealOp calls m.GetParams(ctx).WithDefaults() twice in the same block; can be read once into a local variable (also, GetParams already applies WithDefaults internally)
• Performance: GetAllHealOps full KV scan runs twice per epoch end -- once in expireStorageTruthHealOpsAtEpochEnd and again in scheduleStorageTruthHealOpsAtEpochEnd

Previous reviews

• 9cd434b: Review #1

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}