[Quality][High] Harden multisig threshold and signer-epoch rotation

[Baskarayelu]

Objective

Implement atomic signer/threshold validation with epoch-bound signatures and safe rotation rules.

Why this matters

Signer changes and threshold updates can weaken administrative control if old signatures remain valid or a threshold becomes impossible to satisfy.

This is a substantive production-quality improvement. It must change runtime behavior, security guarantees, correctness, reliability, or meaningful user functionality. It is not a documentation-only, formatting-only, or trivial dependency task.

Scope

Area: multisig governance

Starting points: docs/multisig.md, docs/SIGNER_EPOCHS.md, credence_multisig crate

The contributor should verify the current implementation before changing it and keep the PR limited to this issue. Do not introduce unrelated refactors or weaken existing CI/security gates.

Acceptance criteria

• Threshold is always between one and the active signer count.
• Signer additions, removals, and threshold changes are authorized and atomic.
• Old-epoch signatures cannot authorize new-epoch actions.
• Duplicate signers and duplicate approvals are rejected deterministically.

Required validation

• Test every valid and invalid rotation shape.

• Test duplicate approvals, stale epochs, signer removal, and threshold boundaries.

• Add a property invariant for threshold satisfiability.

• The PR explains the failure mode, the chosen design, backward-compatibility impact, and rollback or migration considerations.

• The PR includes CI evidence and does not contain secrets, generated noise, unrelated cleanup, or disabled checks.

Contributor deliverables

• Open a focused feature branch and do not begin implementation until assigned.
• Reference this issue with Closes #<issue-number> or Fixes #<issue-number>.
• Check off every acceptance criterion in the PR with links to the relevant code and tests.
• Include a security/correctness note explaining why adversarial inputs cannot bypass the new guarantee.

Maintainer quality bar

The PR must be independently reviewable, preserve existing behavior outside this scope, exercise failure paths, and pass the repository's complete required CI/CD checks. Reward eligibility is not guaranteed by this issue or by merging.