refactor: order B20 checks pause → role → input - #101

Refactor MockB20 / MockB20Security so every mutating entrypoint
evaluates cross-cutting gates in the canonical order
pause → role → input → allowance → policy → invariants → effects,
expressed as modifiers on the external surface. Helpers (_transfer,
_mint, _burnRaw) reduce to pure mechanics; _burnSelf is folded
away.

Aligns mock ↔ Rust precompile parity for which error surfaces when
multiple preconditions fail at once (notably transferFrom, where
allowance + executor-policy used to fire before pause + input).

Linear

BOP-215

What changed

MockB20.sol — one new modifier:

• whenNotPaused(feature) — always-strict pause check (no factory
  bypass, see "Bonus" below)

Entrypoints declare whenNotPaused + onlyRole modifiers in
canonical order; zero-address / empty-feature checks are inlined at
each entrypoint (or via the _requireNonZeroActors(from, to) helper
for the four transfer-family entrypoints, which share both checks).
Internal helpers are pure mechanics:

• _transfer → policy + balance + effects
• _mint → policy + supply cap + effects
• _burnRaw → balance + effects
• _burnSelf removed (folded into burn / burnWithMemo direct
  calls to _burnRaw)

MockB20Security.sol — batchMint adds entrypoint
whenNotPaused(MINT) onlyRole(MINT_ROLE) modifiers (previously
inherited from per-element _mint) and inlines per-element receiver
check in the loop. batchBurn adds whenNotPaused(BURN) to its
modifier set. redeem / redeemWithMemo carry whenNotPaused(REDEEM)
on the entrypoint; _redeemBurn body strips its inline pause check.

Interface natspec — IB20.sol and IB20Security.sol rewrite the
revert-order lists for transfer, transferFrom, approve, mint,
burn, burnBlocked, pause, unpause, redeem, batchMint,
batchBurn as explicit numbered lists matching the new order.

Bonus: pause bypass removal

The pre-refactor _transfer / _mint / _burnSelf wrapped their
pause checks in if (!_isPrivileged()) { ... } — i.e. pause honored
the factory bootstrap bypass alongside role and policy. After
discussion, this PR removes that bypass: pause now always fires,
even from the factory during the bootstrap window.

Rationale: role and policy bypass have real bootstrap motivations
(the factory needs to act before having granted itself any roles; the
factory needs to seed initial supply before compliance policies are
configured). Pause has no equivalent motivation — pause defaults to
"nothing paused" at creation, and any pause state during bootstrap is
explicitly opted into by the operator's initCalls. There's no
coherent flow where the factory pauses a feature in initCall N and
then needs to use it in initCall N+1; start-paused configurations
should sequence the pause(...) call last. The same "no init-time
use case → bypass widens attack surface without buying anything"
rationale already documented for redeem / batchBurn applies to
pause generally.

All 592 tests still pass after the change — no test exercised the
factory-bootstrap-with-pause-bypass path, which is strong evidence
the bypass was unintentional / unused in practice.

Implications:

• whenNotPaused is now always strict; whenNotPausedStrict (which
  this PR briefly introduced for the redeem family) is deleted as
  redundant.
• The Rust precompile needs the matching change. Tracked under
  BOP-217.

Tests

All 592 unit tests pass. The 6 *_revertOrder.t.sol files are
updated for the new precedence (renamed pairs, flipped assertions,
canonical-order docstrings). Two happy-path tests in batchMint.t.sol
now grant MINT_ROLE to the caller before triggering
LengthMismatch / EmptyBatch (the role check now fires first via
the entrypoint modifier).

Ran 124 test suites: 592 tests passed, 0 failed, 0 skipped

forge build clean. forge fmt --check clean on all files this PR
touches. (One pre-existing fmt drift in test/lib/B20FactoryLibTest.sol
exists on main — unrelated and not touched here.)

Out of band — Rust precompile parity

The production Rust precompile (separate repo) must be reordered
identically and parity verified on multi-failure inputs, especially
transferFrom. The pause-bypass removal also needs to land Rust-side.
Both tracked under BOP-217.