Auction admin rotation via multisig + timelock

[truthixify]

Tier: M (2-4 days) | Type: security

Context. Wave 7 shipped sealed-bid auctions at stellar/wraith-names/src/auction.rs. The AuctionConfig { admin, treasury, token, reserve_price, launch_time, commit_secs, reveal_secs } sets admin to a single Address at init_auctions, and there is no rotation path. If the auction admin key is lost or compromised there is no on-chain remedy short of the WASM upgrade entrypoint, which is not yet implemented (see wraith-names/tests/upgrade_auth.rs with 4 #[ignore] cases). The rest of wraith-names already has the 7-day multisig rotation flow from Wave 7 #5; auctions should reuse it.

Scope.

• Add rotate_auction_admin(new_admin) gated by the existing wraith-names/src/multisig.rs signer set + 7-day timelock (reuse RotationProposal).
• Emit AuctionAdminRotated(old, new) event.
• Reject rotation while an auction is in the reveal or settle phase (prevents mid-auction admin swap).
• Update stellar/wraith-names/README.md and stellar/MULTISIG.md with the rotation runbook.

Acceptance.

• cargo test -p wraith-names --test auction covers happy-path rotation, timelock enforcement, and rejection during active reveal
• AuctionAdminRotated event emitted with correct topics + data
• stellar/MULTISIG.md runbook rehearsed against futurenet (linked run)
• stellar/wraith-names/README.md documents the rotation surface

Files. stellar/wraith-names/src/auction.rs, stellar/wraith-names/src/multisig.rs, stellar/wraith-names/tests/auction.rs, stellar/wraith-names/README.md, stellar/MULTISIG.md.