fix(proxy): add reentrancy guards and test coverage to UpgradeableProxy

[Osuochasam]

Changes Made

1. Reentrancy Guard Added to proxy.rs (AC-1)

Added crate::non_reentrant!(&env); as the first executable line in all three state-mutating functions, matching exactly the pattern used in control_plane.rs:

• init — proxy.rs#L30
• upgrade — proxy.rs#L47
• verify_integrity — proxy.rs#L65

Grep verification confirms all three guards are in place at lines 30, 47, and 65. No other logic was modified — guard placement and blank-line spacing mirror the ControlPlane convention exactly.

2. Test Coverage Added (AC-2)

Extended tests.rs with proxy tests mirroring the ControlPlane test module structure (helper setup functions, mock_all_auths(), try_* for error paths, #[should_panic] for panic paths):

Test | Coverage -- | -- test_proxy_upgrade_success | Successful upgrade performed by the admin test_proxy_upgrade_rejects_zero_hash | Rejection when new_wasm_hash is [0u8; 32] test_proxy_upgrade_rejects_pre_init | Rejection when upgrade is called before init (no ADMIN_KEY) test_proxy_verify_integrity_rejects_pre_init | Rejection when verify_integrity is called before init test_proxy_upgrade_rejects_non_admin | Rejection when admin's require_auth() fails (no auth mocks, storage seeded directly via as_contract)

Two helper setup functions mirror the ControlPlane pattern:

• proxy_initialized_client(env) — registers contract + calls init with mocked auths
• proxy_setup_client(env) — registers contract only (for pre-init test paths)

3. Verification Results

• cargo test — exited 0; all existing ControlPlane tests + new proxy tests pass
• cargo clippy --lib --tests -- -D warnings — exited 0; no new warnings introduced
• VSCode Diagnostics — zero errors/warnings for both proxy.rs and tests.rs
• Reentrancy guard interference — all normal single-call paths succeed; the guard is transparent to non-reentrant execution as designed

Changes Made 1. Reentrancy Guard Added to proxy.rs (AC-1) Added crate::non_reentrant!(&env); as the first executable line in all three state-mutating functions, matching exactly the pattern used in [control_plane.rs](file:///C:/Users/USA/Documents/Osuocha/vero-core-engine/engine-core/src/core/control_plane.rs#L73-L75):

init — proxy.rs#L30
upgrade — proxy.rs#L47
verify_integrity — proxy.rs#L65
Grep verification confirms all three guards are in place at lines 30, 47, and 65. No other logic was modified — guard placement and blank-line spacing mirror the ControlPlane convention exactly.

2. Test Coverage Added (AC-2)
   Extended tests.rs with proxy tests mirroring the ControlPlane test module structure (helper setup functions, mock_all_auths(), try_* for error paths, #[should_panic] for panic paths):

Test Coverage
test_proxy_upgrade_success Successful upgrade performed by the admin
test_proxy_upgrade_rejects_zero_hash Rejection when new_wasm_hash is [0u8; 32]
test_proxy_upgrade_rejects_pre_init Rejection when upgrade is called before init (no ADMIN_KEY)
test_proxy_verify_integrity_rejects_pre_init Rejection when verify_integrity is called before init
test_proxy_upgrade_rejects_non_admin Rejection when admin's require_auth() fails (no auth mocks, storage seeded directly via as_contract)
Two helper setup functions mirror the ControlPlane pattern:

proxy_initialized_client(env) — registers contract + calls init with mocked auths
proxy_setup_client(env) — registers contract only (for pre-init test paths)
3. Verification Results
cargo test — exited 0; all existing ControlPlane tests + new proxy tests pass
cargo clippy --lib --tests -- -D warnings — exited 0; no new warnings introduced
VSCode Diagnostics — zero errors/warnings for both proxy.rs and tests.rs
Reentrancy guard interference — all normal single-call paths succeed; the guard is transparent to non-reentrant execution as designed

Closes #167

[N-thnI]

please ensure ci pass