proposal(near): clarify and harden refund callback behavior for malformed responses

[omarespejel]

Proposal: NEAR refund callback behavior on malformed callback payloads

This is a proposal issue to align behavior before code changes.

Context

Current refund decision logic in ft-transfer callback handling treats malformed/unexpected callback data as non-refundable.

File context:

• near/omni-bridge/src/lib.rs (is_refund_required path)

Proposal goal

Harden callback-handling behavior for malformed callback payloads with explicit, predictable policy and logging.

Candidate design options

1. Strict fail-closed with explicit rejection state + eventing
2. Controlled fallback path with configurable policy and strong observability

Guardrails

• avoid silent behavior on malformed callback data
• keep compatibility with expected NEP-141 callback semantics

Test expectations

• valid callback values preserve current behavior
• malformed JSON / unexpected payload type follows selected policy
• coverage for promise result error branch

Maintainer input requested

1. Preferred policy for malformed callback data?
2. Is behavior change acceptable behind a feature/config flag?

Tracked under epic: #556