fix: harden fee-path panic sites against malicious transactions

[deblanco]

Context

Production node panicked: called Option::unwrap() on a None value, custom_fee.rs:29:39.

That exact unwrap is not in current source — checked every commit/branch. The deployed binary was built from older code where CustomFeeInfo::new unwrapped max_fee_per_gas.or(gas_price). Rebuilding from main already fixes that specific panic. This PR removes the ~10 other live panic sites still on the fee-handling path, reachable from user-submitted transactions.

Changes

Critical — remote DoS (attacker-reachable)

• sponsored-transactions, zero-gas-transactions: signature.as_slice().try_into().unwrap() panicked on any signature ≠ 65 bytes, reachable from the tx pool. Now validates length and rejects with BadProof.

High — storage unwraps (panic on every tx if storage unset)

• dnt-fee-controller: 5 unwraps on FeeVaultPrecompileAddressStorage / ValidatorPercentageStorage (fee withdraw/refund/pay path). Storages converted to ValueQuery with type_value defaults (0x…0807, 50). Encoding-compatible — no migration.
• validator-fee-selector: nested DefaultController::get().unwrap() inside an eager unwrap_or (panicked even when the outer value was Some). Now unwrap_or_else; a missing controller degrades to the existing (1,1) rate fallback.

Medium

• sponsored:188 / zgt:186: dispatch.actual_weight.unwrap() → falls back to the declared gas limit (worst case, user-safe).
• custom_fee.rs: match_validator_conversion_rate_limit used asymmetric checked_mul overflow fallbacks (user-side overflow auto-accepted; attacker controls the user numerator via max_fee_per_gas). Replaced with exact U256::full_mul (U512) comparison — overflow branch removed. ⚠️ Consensus-relevant in overflow edge cases — bump spec_version before deploying to a live chain.
• fee-rewards-vault-controller precompile: set_validator_percentage(...).unwrap() → revert.

Hardening

• Runner substate expect()s kept (mirror upstream Frontier executor invariant, not user-reachable) — documented with an invariant comment + #[allow(clippy::expect_used)].
• #![cfg_attr(not(test), deny(clippy::unwrap_used))] on the 6 fee-path crates as a regression guard (expect_used too on non-pallet crates; FRAME macros expand to expect() internally).

Tests

New cases: short/empty signatures, killed storage falling back to defaults without panic, zero denominators, U256::max_value() cross-product overflow on both sides.

• cargo test: stbl-tools 12, dnt 13, validator-fee-selector 10, sponsored 9, zgt 4, runner 24, precompile 7 — all pass.
• cargo clippy clean on all 6 crates.
• cargo check --workspace clean.

Follow-up (out of scope)

• Runner maps all fee errors to generic FeeOverflow — masks insufficient-balance vs arithmetic vs impl error.
• Fee log emits U256::max_value() on validator_fee + dapp_fee overflow (silent masking).
• ZGT (max_fee_per_gas == 0) skips the fee event log entirely — no operator record.