Accounts Refactor PR 2: Adding address_override param to tx

[citizen-stig]

Description

Adds a signed address_override: Option<S::Address> field to V0 and V1 (multisig) transactions, threaded into AuthorizationData.address_override.
Resolve_context branches on it: Some(X) verifies (X, credential_id) ∈ account_owners via PR #2770 's is_authorized;
None keeps today's resolve_sender_address flow.
CHAIN HASH BREAKING for V1.

First commit: 7d2ab42

PR #2770 froze writes to the legacy credential_id → address map;
InsertCredentialId now only marks (sender, credential) authorized, without rerouting that credential's default.
That means a rotated multisig (new keys → new credential_id.into()) has no way to keep acting as the original address.
address_override is the signed channel that lets a signer declare which authorized address to execute as.

Design tradeoffs

• V0 and V1 wire break, no grace period. CHAIN_HASH_OVERRIDES covers signature-level grace only (post-deserialize). Adding a borsh field breaks deserialization of pre-upgrade V0/V1 bytes regardless of chain hash, so a grace period isn't meaningful.
• Unauthorized Some(X) is Skipped, not Reverted. We haven't resolved a sender yet, so there's no account to charge — sequencer pays inclusion cost, user is unaffected. Matches the existing pre-execution-error receipt category (same path as bad signatures). Error string is preserved in the receipt.
• Read-only check. The Some(X) path never writes to account_owners. Auto-registration only happens on the None path.
• Explicit builder parameters. to_multisig_tx and sign_utx_v1_in_place take the target as an argument rather than defaulting to None with callers assigning the public field afterwards — avoids a half-baked API in an SDK recommended pattern.

Audit invariants

1. V1's credential_address field (multisig malleability commitment) is untouched.
2. address_overred is inside the V1 signed bytes — post-sign tampering invalidates the signature (test: test_v1_target_tamper_breaks_signature).
3. Some(_) path does exactly one read of account_owners; never writes.
4. Failed Some(_) → TxEffect::Skipped, sequencer penalized, user never charged.

Notable side-effects

• test_multisig_signature_verification in the EIP-712 integration test was already silently broken by PR Accounts Refactor PR 1: Adding account -> [credential_id] mapping #2770 (the multisig credential no longer routed to admin after InsertCredentialId, leaving gas on an unfunded default). Fixed here by signing with address_override = Some(admin.address()) — doubles as an EIP-712-meets-target-address smoke test.

---

• I have updated CHANGELOG.md with a new entry if my PR makes any breaking changes or fixes a bug. If my PR removes a feature or changes its behavior, I provide help for users on how to migrate to the new behavior.
• I have carefully reviewed all my Cargo.toml changes before opening the PRs. (Are all new dependencies necessary? Is any module dependency leaked into the full-node (hint: it shouldn't)?)

Linked Issues

• Related to sov-accounts refactoring and extending #2772

Testing

New tests are added

Docs

Updated doc-strings and comments

[theodorebugnet]

LGTM, but is there a reason we avoid adding it to V0 transactions? Note that the theodore/multisig-upgrade branch is going to be a hard fork and require a new rollup binary regardless, with a coordinated upgrade height using the rollup manager. The previous changes on this branch already break the V0 format (UnsignedTransaction::V0 {...} is not byte-compatible with the old UnsignedTransaction, by design).

Adding it to both cases would IMO simplify things conceptually: this way, the differences between V0 and V1 are the signing protocol, while the actual transaction features remain the same.

[theodorebugnet]

LGTM, almost all comments are doc nits except the redundant argument to to_multisig_tx() in unsigned/v0.rs which I think needs fixing

[citizen-stig]

LGTM, almost all comments are doc nits except the redundant argument to to_multisig_tx() in unsigned/v0.rs which I think needs fixing

Thanks @theodorebugnet , keeping the bar. Many things slipped through while repurposing PR to support of the target_address for V0 tx too.