fix(security): H-01 — chunked retryPendingDebt + audit findings docs

[jhfnetboy]

Stacked PR 4/4 (merge after C-02/C-03). Base: sec/c02-c03-x402-auth.

Fixes H-01: retryPendingDebt always retried the full pending balance, so a balance > the token's maxSingleTxLimit reverted forever (only clearPendingDebt write-off remained). Now takes an explicit amount (clamped) so a large balance is recovered in chunks. Reuses existing recordDebt + pendingDebts. Ops runbook: docs/operations/pending-debt-runbook.md. Also lands the final findings-resolution + KMS #16 consistency docs. forge test 970 green.

[fanhousanbu]

✅ APPROVE — H-01 chunked retryPendingDebt

Logic verified:

function retryPendingDebt(address token, address user, uint256 amount) external onlyOwner nonReentrant {
    uint256 pending = pendingDebts[token][user];
    if (pending == 0) revert NoPendingDebt();
    if (amount == 0 || amount > pending) amount = pending;  // clamp
    pendingDebts[token][user] = pending - amount;           // safe: amount ≤ pending
    IxPNTsToken(token).recordDebt(user, amount);
    emit PendingDebtRetried(token, user, amount);
}

• Clamp on entry (not after): prevents over-retry and handles the amount == 0 → "full balance" shortcut cleanly. ✅
• NoPendingDebt check on the pre-clamp pending value → correct (if amount == 0 would be clamped to pending, you'd still want to revert when pending == 0). ✅
• pendingDebts updated BEFORE recordDebt external call. The nonReentrant guard is present, and the write-before-external-call ordering is correct anyway (CEI). ✅
• Event carries actual retried amount (post-clamp), not the input. ✅

Operability: If recordDebt itself reverts (e.g., the amount chunk still exceeds xPNTs maxSingleTxLimit), the pendingDebts update is rolled back atomically. The caller must retry with a smaller chunk. The pending-debt runbook should document the chunk sizing strategy. This is by design.

Breaking change: 2-arg → 3-arg signature. In-repo E2E callers updated in the same PR. ✅

---

All 4 fixes are independent, minimal, and correctly address the attack vectors. Stack ready to merge in order: #225 → #226 → #228 → #227.