fix: check held balance in rescue operation

[jaime-iobermudez]

Summary
Fixes a Medium-severity vulnerability (reported by the security audit) where the rescue operation could drain stablecoin tokens held in escrow on behalf of token holders.

When a hold is created, the holder's tokens are wiped and an equivalent amount is minted into the stablecoin contract (the treasury) as escrow, tracked by totalHeldAmount. The rescue function only checked the contract's raw token balance and did not subtract the held obligations, so an account with the _RESCUE_ROLE could transfer out the escrow backing active holds — leaving hold records without backing tokens and causing executeHold / releaseHold / reclaimHold to fail.

This aligns rescue with the existing burn logic, which already excludes held amounts via getBurnableAmount().

Changes
Contracts

RescuableFacet.sol: added getRescuableAmount() (balanceOf(contract) − totalHeldAmount) and a checkRescueAmount modifier; rescue() now validates against the rescuable (unreserved) amount instead of the raw contract balance. Registered the new selector.
IRescuable.sol: added the getRescuableAmount() signature and the RescuableAmountExceeded(int64 rescuableAmount) error.
SDK (mirrors the existing burn flow)

New GetRescuableAmountQuery + handler and RescuableAmountExceeded domain error (ErrorCode 20017).
RPCQueryAdapter.getRescuableAmount() calling the new contract view.
ValidationService.checkRescuableAmount() and a pre-flight check in RescueCommandHandler (kept the existing treasury-balance check as well).
Registered the query handler in Injectable.
Tests
hold.test.ts: new "Rescue when held amount greater than 0" block (mirrors the existing burn-with-hold test) — rescuing the full balance with an active hold reverts with RescuableAmountExceeded; rescuing only the unreserved amount succeeds and leaves the escrow intact.
rescuable.test.ts: updated the over-balance case to assert the new RescuableAmountExceeded error.
jest-setup-file.ts: mocked getRescuableAmount.

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud