fix(keyring-sdk): reject negative migration state versions

A negative version passed the upper-bound check and made
`steps.slice(version)` use negative-index semantics, silently applying
the wrong subset of migration steps instead of throwing. Also fixes a
docs formatting issue flagged by CI.

Author: danroc

packages/keyring-sdk/docs/migrations.md

@@ -6,8 +6,10 @@ Versioned state is stored as an envelope:
 
 ```json5
 {
-  "version": 1,
-  "data": { /* Keyring state */ }
+  version: 1,
+  data: {
+    // Keyring state
+  },
 }
 ```
 

packages/keyring-sdk/src/migration.test.ts

@@ -270,6 +270,14 @@ describe('apply', () => {
         'State version 5 is newer than the latest migration version 1',
       );
     });
+
+    it('throws when state version is negative', async () => {
+      const migrations = createMigrations().add({ migrate: (data) => data });
+
+      await expect(migrations.apply({ version: -1, data: {} })).rejects.toThrow(
+        'State version -1 is invalid; it cannot be negative',
+      );
+    });
   });
 
   describe('when migrate is async', () => {

packages/keyring-sdk/src/migration.ts

@@ -155,6 +155,12 @@ async function applySteps<Data extends Json>(
   const latestVersion = steps.length;
   const { version, data: initialData } = getVersionAndData(state);
 
+  if (version < 0) {
+    throw new Error(
+      `State version ${version} is invalid; it cannot be negative`,
+    );
+  }
+
   if (version > latestVersion) {
     throw new Error(
       `State version ${version} is newer than the latest migration version ${latestVersion}`,