[SECURITY][IDEMPOTENCY] Scope contract references by operation, pool, and actor to prevent cross-pool preemption

[Obiajulu-gif]

Summary

Reference receipts use a single global key. An unrelated user can submit a predictable reference first on another pool/operation, causing the legitimate request to fail as a duplicate.

Repository evidence

• contracts/chainmove-pool/src/lib.rs defines DataKey::Reference(String) without operation, pool, or actor scope.
• Replay validation rejects the same key when stored receipt fields differ.

Scope

• Derive the idempotency key from domain/version, operation kind, pool ID, actor/participant, and external reference.
• Provide a compatibility rule for existing receipts.
• Hash or bound composite keys to control storage cost.

Acceptance criteria

• The same external reference can safely exist in unrelated scoped domains.
• A duplicate within the same scope remains idempotent and conflicting payloads are rejected.
• No user can preempt another pool/actor solely by guessing its reference.

Tests

• Cross-pool, cross-operation, cross-actor, exact-retry, and conflicting-retry tests.
• Migration test for legacy global receipts.

Non-goals

• Extending receipt retention; that is tracked separately.

[akintewe]

I've been creating intricate forms and e-commerce systems for more than four years as a full-stack developer. I have designed inventory management systems for agricultural enterprises and have experience with image processing and large-scale state management. I have also worked on this project in the past.
My ETA is one hour, and I would love to work on this problem.

[grantfox-oss]

🦊 GrantFox — @akintewe has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #181)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@akintewe's PR #213 was approved and merged by @Obiajulu-gif.

🏆 @akintewe: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (815 total points). Track your full progress on GrantFox.

👏 Great work, @akintewe! Keep contributing to Chainmove.