Add universe-aware security pool liquidator

[KillariDev]

Summary

• add a configurable security-pool liquidator with pool discovery, selection, statistics, candidate evaluation, vault creation/use, REP health management, staged liquidation execution, fee redemption, and durable restart recovery
• let operators browse the Zoltar universe tree, approve one coherent truthful fork path, inherit selected-pool intent into approved children, and migrate vaults during the protocol migration window
• extract shared Ethereum, signer, submission, quorum, connectivity, block-sync, resilience, CEX, DEX, and cross-venue consensus primitives into bots/shared
• update both bots to use a manipulation-resistant REP estimate built from independently configured CEX and DEX price/liquidity evidence

Market-price safeguards

• query arbitrary operator-configured CCXT exchanges through unified public ticker and order-book APIs, including direct REP/ETH books or exact ETH cross markets
• observe configurable Uniswap-V2-style pairs with canonical block identity; the arbitrager also retains authenticated dynamic V2/V3/V4 observation
• enforce exact chain/token identity, globally unique failure domains, freshness, executable two-sided depth, dispersion, total quorum, and temporal persistence
• use leave-one-source/leave-one-market-out references so a candidate venue cannot validate itself
• require independent CEX/DEX agreement, with only an explicit operator-controlled single-group fallback
• keep exact root and child-universe REP estimates isolated and clear every DEX-derived estimate after canonical-head replacement or final-boundary failure
• show persistence-aware Admitted/Excluded source status separately from one-shot Observed/Failed diagnostics, with an explicit route back to active admission
• provide bun run smoke:markets -- http://127.0.0.1:4183; the smoke script is also included in the liquidator image context

Fork, pool, and execution behavior

• reject unknown universes, conflicting sibling approvals, and descendants whose implied truth path conflicts
• show discovered pools and their universe, collateral, vault, health, candidate, fee, and staged-operation statistics
• operate only selected pools in approved universes; optionally deploy missing desired origin pools
• detect/create/fund the bot vault, migrate it into approved children when applicable, and maintain configurable REP-health and exposure bounds
• recheck pause state, canonical market evidence, gas/oracle funding, wallet reserve, and REP exposure at transaction boundaries
• retain ambiguous price-dependent intents without rebroadcast across restart
• allow paused-only reconciliation of a finalized cancellation/replacement after validating the signed intent chain, exact hash, RPC quorum, sender, nonce, canonical receipt ancestry, and 12-block finality
• save reconciled state before swapping in-memory journal state, so persistence failure remains execution-blocking

Operator UI

• browse/approve universes, select pools, inspect pool/market statistics, and configure migration, exposure, health, fee, gas, CEX, DEX, and execution strategy
• test every saved source, see truthful probe/admission reasons, and switch between probe results and current persisted admission
• surface live alerts for pending journals, blocked required consensus, single-group fallback, and repeated reorg resets across root and discovered child REP assets
• provide accessible paused-only recovery controls and preserve focused controls/expanded addresses across polling

Surface	Desktop	Mobile
Source probe
Transaction recovery
Arbitrager

Screenshots expire after 90 days.

Validation

• cd bots/liquidator && bun run check — 64 tests, 196 assertions; typecheck and formatting passed
• bun run tsc — passed
• bun run ensure-contract-artifacts && bun run check:shared-dependencies && bun run test:run -- --bail=1 — 2,559 passed, 16 intentional external Uniswap integration skips, 0 failed, 7,757 assertions
• bun run format:check, bun run check:changed, bun run knip, and final git diff --cached --check — passed
• market smoke — two CEX and two DEX sources observed
• Chromium QA at 1440×900 and 390×844 — no runtime diagnostics or horizontal overflow; source probe/admission, alerts, recovery, loading, failure, dry-run, paused, and live-paused states exercised
• final visual review — 96/100, no High, Medium, or Low findings
• final code/safety review — 97/100, no High, Medium, or Low findings
• branch-current gate — 0 commits behind origin/main

Documentation review was skipped because no docs/ files changed. Generated-clean validation was skipped because no contracts, generators, tracked generated artifacts, or artifact policy changed. Docker/Podman were unavailable, so image packaging was inspected statically rather than built. Live CEX/RPC/signing behavior remains intentionally external to deterministic validation.