Delayed executor audit issues

[remollemo]

This change is 

[cursor]

PR Summary

High Risk
Changes core multisig timelock and expiration rules and breaks the IDelayedExecutor ABI with a required salt; wrong client assumptions about timers or keys can block or mis-time governance execution.

Overview
Addresses delayed-executor audit findings by changing MultiExecutor timelock semantics and extending the public API so identical call batches can coexist.

submit_calls / exec_calls now take a salt; the call-set key is poseidon(serialize(calls) ++ [salt]), so two identical batches can be in flight under different salts (0 remains the default). Integrators must pass the same salt at submit and execute, and off-chain proposals should specify (calls, salt).

MultiExecutor timer behavior is reworked: the delay timer starts only on the first threshold crossing and is not cleared when approvals dip below threshold (only full withdrawal to zero resets delay and expiration). On that first crossing, call_set_expiration is re-anchored to Td + E (with an initial T0 + E anti-rot deadline on the first signature), yielding a fixed post-threshold executable window of E - D. The constructor now rejects execution_expiration <= execution_delay via EXPIRATION_BELOW_DELAY, and CallSetTimerStarted is emitted when the delay timer starts (with updated allowed_time and expiration).

SPEC.md documents the new model, invariants, limitations, and monitoring guidance; tests are updated for the salt API and expanded with regressions for write-once timers, re-anchoring, salts, and larger owner sets. .tool-versions adds voyager 1.0.0.

^{Reviewed by Cursor Bugbot for commit 411286b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

❌ Patch coverage is 98.74327% with 7 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@14ed38d). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...ckages/delayed_executor/src/delayed_executor.cairo	25.00%	3 Missing ⚠️
packages/delayed_executor/src/multi_executor.cairo	85.71%	2 Missing ⚠️
packages/delayed_executor/src/common.cairo	50.00%	1 Missing ⚠️
...ages/delayed_executor/tests/test_multi_owned.cairo	92.85%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #182   +/-   ##
=======================================
  Coverage        ?   95.81%           
=======================================
  Files           ?       88           
  Lines           ?     7264           
  Branches        ?        0           
=======================================
  Hits            ?     6960           
  Misses          ?      304           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.