[Quality][High] Enforce bond issuance authorization and asset conservation

[Baskarayelu]

Objective

Make issuance a single validated transaction that binds the owner, token, amount, and resulting bond record.

Why this matters

Bond issuance combines caller identity, token custody, principal, duration, and status. A missing authorization or partial transfer can mint a claim without matching custody.

This is a substantive production-quality improvement. It must change runtime behavior, security guarantees, correctness, reliability, or meaningful user functionality. It is not a documentation-only, formatting-only, or trivial dependency task.

Scope

Area: bond issuance

Starting points: bond and registry crates; docs/BOND_ISSUANCE.md, docs/balance-keying.md

The contributor should verify the current implementation before changing it and keep the PR limited to this issue. Do not introduce unrelated refactors or weaken existing CI/security gates.

Acceptance criteria

• Only the permitted issuer/owner path can create a bond.
• Zero, unsupported, and over-limit amounts are rejected before transfers.
• Stored principal and token identity exactly match the custody movement.
• A failed transfer creates no bond record and does not increment issuance counters.

Required validation

• Cover unauthorized, duplicate, unsupported-token, boundary, and failed-transfer cases.

• Add conservation assertions between token balances and bond liabilities.

• Run workspace tests, clippy, and no_std/WASM checks.

• The PR explains the failure mode, the chosen design, backward-compatibility impact, and rollback or migration considerations.

• The PR includes CI evidence and does not contain secrets, generated noise, unrelated cleanup, or disabled checks.

Contributor deliverables

• Open a focused feature branch and do not begin implementation until assigned.
• Reference this issue with Closes #<issue-number> or Fixes #<issue-number>.
• Check off every acceptance criterion in the PR with links to the relevant code and tests.
• Include a security/correctness note explaining why adversarial inputs cannot bypass the new guarantee.

Maintainer quality bar

The PR must be independently reviewable, preserve existing behavior outside this scope, exercise failure paths, and pass the repository's complete required CI/CD checks. Reward eligibility is not guaranteed by this issue or by merging.