[PR #37] p0-blocker: profit swept to hot-wallet owner, not cold wallet — violates CLAUDE.md safety invariant

[obchain]

PR: #37 feat(contracts): full Aave + Venus + PancakeSwap liquidation flow
Commit: 54fe2bb
File: contracts/src/CharonLiquidator.sol lines 305-312

Problem: After flash-loan repayment contract transfers profit directly to owner:

uint256 profit = finalBal - totalOwed;
if (profit > 0) {
    IERC20(p.debtToken).transfer(owner, profit);
}

owner set to msg.sender in constructor — the hot operational wallet that signs liquidation transactions. CLAUDE.md safety invariant requires profit to flow to a separate immutable cold wallet, not the hot signer. Compromised hot key therefore drains accumulated profit in the same transaction that executes liquidation.

Impact: Critical operational security failure. Hot wallet key phished or leaked → attacker crafts liquidation call routing profit directly to themselves, or key loss alone exposes entire revenue stream.

Fix: Add COLD_WALLET immutable:

address public immutable COLD_WALLET;

Accept as separate constructor argument (not msg.sender) and sweep profit to COLD_WALLET instead of owner. owner retains operational permissions; COLD_WALLET holds funds. Document distinct addresses requirement in NatSpec.

[obchain]

Fixed on feat/12-charon-liquidator-full in 856e8c3.

• New immutable address public immutable COLD_WALLET set at construction, validated non-zero.
• Constructor signature extended to (address _aavePool, address _swapRouter, address _coldWallet).
• Inside executeOperation, profit is transferred to COLD_WALLET (never to owner) before the Aave repayment approval, so a compromise of the hot/bot key cannot drain accumulated profit.
• LiquidationExecuted extended with an indexed recipient param so off-chain monitors can filter swept profit by cold wallet.
• Existing safety invariants preserved: executeLiquidation stays onlyOwner, the Aave-pool msg.sender gate on the callback is untouched, simulation gate upstream remains intact.

Restores the CLAUDE.md invariant that the bot hot wallet holds gas only.