[CO-03] Fix Checks-Effects-Interactions violation in payment contract release_payment()

[Leothosine]

Problem

contracts/payment/src/lib.rs:190-243 - release_payment() performs two token transfers BEFORE updating the payment status:

token_client.transfer(..., &payment.restaurant_wallet, &net_amount); // external call
token_client.transfer(..., &treasury, &payment.fee_amount);          // external call
payment.status = PaymentStatus::Released;                             // state update LAST

This violates the Checks-Effects-Interactions pattern. If the token contract triggers re-entry during transfer, a second release_payment() call could execute with status still set to Escrowed, draining the escrow twice.

Proposed Solution

Reorder to Checks-Effects-Interactions:

1. Validate all preconditions (status == Escrowed, caller auth) - CHECKS
2. Set payment.status = PaymentStatus::Released and persist to storage - EFFECTS
3. Perform both token_client.transfer() calls - INTERACTIONS

Add a releasing: bool reentrancy guard to storage that panics if already set on entry.

Acceptance Criteria

• payment.status is persisted to storage BEFORE the first token_client.transfer() call
• A mock token contract that calls release_payment() during transfer() is rejected by the reentrancy guard
• Reentrancy guard is cleared after both transfers complete
• All existing happy-path tests continue to pass
• Unit test verifies the order of state mutation vs external calls

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!

[wumibals]

Hi Team. You assigned me the earlier task which is related to this task, since i am working on the other issue, integrating this will be easier to do as i understand the structure and arrangements better.

[grantfox-oss]

🦊 GrantFox — @wumibals has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #281)
2. Your PR will be reviewed by the tosirano maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@wumibals's PR #292 was approved and merged by @Leothosine.

🏆 @wumibals: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (188 total points). Track your full progress on GrantFox.

👏 Great work, @wumibals! Keep contributing to tosirano.