Recovery functions desync the dedicated escrow storage key from `shipment.escrow_amount`

[dinahmaccodes]

Tier: Hard
Description: Every normal escrow-mutating path calls persist_shipment, which writes both storage::set_shipment and storage::set_escrow together. unlock_escrow, recover_shipment, clear_finalization, rollback_on_external_failure (recovery.rs:149-357) call storage::set_shipment directly and never storage::set_escrow, guaranteeing consistency::check_shipment_invariants (which diffs shipment.escrow_amount against storage::get_escrow) will flag a false EscrowMismatch the moment any of them runs. They also bypass validate_shipment_invariants entirely.
Files: contracts/shipment/src/recovery.rs:149-357, contracts/shipment/src/lib.rs:194-199
Tasks:

• Route all four recovery functions through persist_shipment (or an equivalent that keeps storage::set_escrow in sync), and run validate_shipment_invariants
  Acceptance Criteria:
• Running any recovery function never produces a false EscrowMismatch

[akandeisaac021-design]

@akandeisaac021-design has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi there, I'd like to contribute to this.

I'll implement this following the existing conventions in the codebase, with tests covering the new behavior.

Looking forward to contributing — please assign this issue to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @akandeisaac021-design to this issue.

[CodeNinjaStephen]

@CodeNinjaStephen has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, I'd like to work on this one if it's still available. Happy to be assigned. Thanks!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @CodeNinjaStephen to this issue.