fix(genesis-tool): close 4 medium audit findings (#533–#536)

[ByteYue]

Summary

Closes four medium-severity findings from the Galxe/gravity-audit batch against the genesis-tool crate. Each fix converts a silent / heuristic failure mode into a loud, fail-closed invariant so a misconfigured input cannot ship a broken genesis through CI.

Audit issue	Fix
Galxe/gravity-audit#533 — votingPower decoupled from stake_amount at genesis	Assert voting_power == stake_amount per validator in convert_config_to_sol (genesis.rs) — ValidatorManagement.initialize bypasses _validateRegistration, so this tool is the only line of defense.
Galxe/gravity-audit#534 — extract_runtime_bytecode no-op heuristic	Rename to decode_runtime_bytecode, drop the dead 0x60/0x61 branch + noisy WARN (both arms returned the same bytes; all Solidity runtime starts with 60 80 60 40, so the heuristic could not distinguish constructor from runtime). Document the caller contract: must supply deployedBytecode.object (already done by scripts/helpers/extract_bytecode.py).
Galxe/gravity-audit#535 — run_generate exits Ok(()) on verify failure	Plumb Result<(), String> through print_active_validators_result → handle_execution_result (now takes a fallible success_handler) → verify_result → run_generate, so a validator-count mismatch becomes a non-zero exit instead of a buried error log.
Galxe/gravity-audit#536 — parse_u256_hex silently returns zero on parse failure	Return Result<U256> and propagate at all three callsites with context naming the offending address/key. A malformed balance/storage value now fails verification instead of silently zeroing the account.

Notes

• The extract_runtime_bytecode heuristic in #534 fired on every legitimate run (all .hex artifacts start with 60 80 60 40), but both branches of the if/else returned the same bytes, so this was log noise rather than a behavior bug. Current pipeline (via scripts/helpers/extract_bytecode.py reading deployedBytecode.object) was never affected; the rename + comment makes the caller contract explicit so a future pipeline change cannot resurrect the trap.
• The signature change for handle_execution_result (success_handler now returns Result<(), String>) is internal — print_active_validators_result is its only external caller.
• The #536 fix preserves the existing hex-only format expectation; if reth-standard decimal balances are also intended to be accepted, that is a separate scope (currently the generator also writes hex, so they're consistent).

Test plan

• cargo check -p genesis-tool — clean (warnings are pre-existing).
• cargo build -p genesis-tool — clean.
• cargo test -p genesis-tool — 0 tests, all pass (no existing tests in the crate).
• Manual smoke: run genesis-tool generate against the current new_genesis_config.json and confirm exit 0 (happy path unchanged).
• Manual smoke: deliberately set voting_power != stake_amount for one validator → expect panic from #533 assertion.
• Manual smoke: feed verify a genesis.json with a decimal balance string → expect non-zero exit citing the offending address (was: silent success).

🤖 Generated with Claude Code