fix(spend-permission): throw in production guard instead of console.warn

[faisalnugroho]

Summary

The production guard in createSpendPermissionTypedDataWithSeconds (utils.ts:126-131) uses console.warn which only logs a warning but allows the test-only function to execute in production.

Impact: The @testOnly function can be accidentally used in production without any hard failure, potentially causing incorrect spend permission behavior with raw seconds instead of days.

Fix

Changed console.warn(...) to throw new Error(...) to prevent silent misuse in production environments.

Test Plan

• Existing tests pass
• Verify that calling this function in production mode throws an Error

Closes #325

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[faisalnugroho]

Hi! Following up on this bug fix PR. This PR changes the production guard from console.warn to a thrown error when an invalid spend permission is detected. Currently, invalid permissions silently pass through in production, which could allow unauthorized spend operations. Would appreciate your review.

All CI checks pass (StepSecurity ✅). Would love to get your review when you have a moment. Thanks!

[faisalnugroho]

Hi! I'd love to get this PR reviewed when you have a moment. This PR addresses throw in production guard instead of console.warn. Happy to make any adjustments based on your feedback. Thank you!