[security] Wire assertCanonicalDispatchTarget into prepare_* handlers

[szhygulin]

Summary

Follow-up to #480 which introduced src/security/canonical-dispatch.ts — the MCP-side mirror of skill v8's Invariant #1.a allowlist — but did NOT wire assertCanonicalDispatchTarget into individual prepare_* handlers.

Why deferred from #480

Different prepare flows have different tx-chain shapes:

• Single-tx (prepare_lido_stake → outer to is stETH directly)
• Approve+action multi-leg (prepare_aave_supply → outer to is the token contract for approval, tx.next.to is the Aave Pool)
• Multi-step Solana flows (different shape entirely; non-EVM, not covered by Inv Add CI workflow: typecheck + tests on Node 20/22 #1.a)

A correct wiring needs per-flow review to identify which leg(s) of each tx tree carry the canonical-target check. Bundling that review into #480 would have violated the smallest-solution discipline (CLAUDE.md). The helper exists with a regression test that asserts the allowlist stays in sync with src/config/contracts.ts; the wiring is the second-order improvement.

Scope

For each prepare_* tool the helper covers (prepare_aave_*, prepare_compound_*, prepare_lido_stake/_unstake, prepare_morpho_*, prepare_uniswap_swap, prepare_uniswap_v3_*, prepare_eigenlayer_deposit):

1. Identify the leg of the returned UnsignedTx chain whose to should match the canonical target (typically the action leg, possibly nested under tx.next after an approval).
2. Call assertCanonicalDispatchTarget(toolName, chain, leg.to) at that point.
3. Add an integration test that mocks the underlying build* function to return a to outside the allowlist and asserts the prepare flow throws INV_1A.

Defense layering

• Skill-side Inv Add CI workflow: typecheck + tests on Node 20/22 #1.a (skill v8 §1.a, agent-side independent verification) is the load-bearing defense against the rogue-MCP threat (smoke-test b117).
• This MCP-side wiring is defense-in-depth: catches an internal bug or supply-chain tamper that substitutes the target inside a build* function. The skill's defense doesn't go away if this wiring is missing — but the layered defense is the design goal of [security] Add Invariant #1.a — outer-to canonical-contract allowlist #461.

Source

#461, #480.