Small consistency fixes in the vault and oracle #423

Priority

Low

User story / Problem statement

A review of the vault and oracle found four small consistency gaps: one place reads an oracle view directly instead of through its trapping-safe form, one entrypoint is missing a setup guard every sibling entrypoint already has, and two doc comments describe behavior the code no longer matches.

As a maintainer, I want these corrected so a swapped-in oracle or an open-setup vault cannot abort a call with a host error instead of a named one, and so the docs describe what the code actually does.

Problems

• contracts/async-vault/src/guards.rs:272-277 (feed_valid) calls the trapping feed.state(). A swapped-in oracle that traps on state() aborts request_deposit with a host error instead of FeedNotValid, while epoch.rs and health.rs already use the try_ form.
• contracts/async-vault/src/wind_down.rs:80-82 (propose) does not check that setup is closed, so the admin can propose a wind-down while setup is open.
• The doc comment above OracleState in contracts/nav-oracle/src/state.rs:5-12 calls the NAV pause an "issuer freeze" and says both mint and redeem halt on Stale, which does not match who pauses the NAV or what the vault actually refuses.
• docs/kit-spec.md does not say that the share token's burn needs the manager role (the vault) as operator and that holders have no burn/burn_from of their own.

Expected outcome

feed_valid treats a trap or an error from the feed the same as an invalid state, refusing with FeedNotValid. propose_wind_down refuses while setup is open, with the same error the other setup-gated entrypoints use. The OracleState doc comment matches the code: who pauses and clears the NAV, and what stays open on Stale/Paused. kit-spec.md states the share token's burn authority.

Acceptance criteria

• A feed that traps on state() is refused with FeedNotValid from request_deposit, with a test covering it
• A wind-down cannot be proposed while setup is open, refused with the setup guard's error, with a test covering it
• The OracleState doc comment, the entrypoint's # Errors doc, docs/AUTHORIZATION_MATRIX.md and docs/kit-spec.md / the design doc are updated to match
• The affected contracts' test suites still pass