fix: issues #183 #185 #189 #203 + pre-existing CI failures

[Anuoluwapo25]

closes #189 – Block upgrade while vault is paused

• Add require_not_paused() guard to upgrade() so a compromised WASM cannot be pushed while the vault is in a degraded (paused) state.
• New tests: test_upgrade_blocked_while_paused, test_upgrade_unpaused_vault_clears_pause_guard.

closes #185 – Validate expected_apy in rebalance

• Assert (0..=10_000).contains(&expected_apy) before any protocol logic; rejects negative or >100 % APY values with a clear error.
• New tests: test_rebalance_apy_boundary_values_accepted, test_rebalance_negative_apy_rejected, test_rebalance_apy_above_max_rejected.

closes #183 – TVL cap uses TotalAssets (not TotalDeposits)

• require_within_tvl_cap now reads TotalAssets (principal + yield) so yield accrual does not silently allow over-subscription past the cap.
• New test file test_total_assets_cap.rs with regression tests covering deposit → yield → withdraw → cap check lifecycle.
• ARCHITECTURE.md: document TotalDeposits vs TotalAssets relationship.

closes #203 – Budget benchmark tests

• New test_budget.rs with CPU/memory upper-bound assertions for deposit, withdraw (no-Blend), withdraw (Blend pull), rebalance→blend, rebalance→none.
• ARCHITECTURE.md: document baseline ledger resource costs per operation.

Pre-existing CI failures fixed (16 → 0)

• emergency_pause tests passed agent address instead of owner → fixed to use owner throughout (test_pause, test_events, test_event_schema).
• set_blend_pool tests passed agent instead of owner → fixed (test_events, test_event_schema, test_blend_integration).
• test_owner_can_set_blend_pool used a bare Address (not a contract) as the Blend pool → changed to use setup_vault_with_token_and_blend.
• test_event_schema_ownership_transfer_events had wrong destructuring order for setup_vault return tuple → fixed (contract_id, _agent, owner).
• test_math_limits: wrong expected panic messages and non-triggering overflow tests → replaced with correct expectations and functional assertions.

[drips-wave]

@Anuoluwapo25 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits