Fix router simulation/spread bugs; harden ops per deployment testing

[Bluechip23]

Three router-path bugs found in end-to-end deployment testing:

1. Simulation errored on standard-pool hops: it sent the commit-only IsFullyCommited query to every pool. It now resolves each hop against the factory registry (mirroring execution's validation, and rejecting unregistered pools up front) and only commit pools get the commit-phase check.
2. Pool simulations quoted optimistically: query_simulation and query_reverse_simulation derived reserves from the contract's bank/cw20 BALANCES, which also hold LP fee reserves, the creator fee pot, and commit proceeds. They now quote from POOL_STATE — the exact reserves execution trades against — fixing direct pool quotes and every chained router quote.
3. Every hop silently inherited the pools' 0.5% default max_spread (None is substituted, not disabled), failing thin-pool routes regardless of the caller's minimum_receive. The router now pins each hop to the pools' 5% hard cap so minimum_receive is the binding, end-to-end slippage control the docs promise.

Tests: standard-pool hop simulate+execute, forwarded max_spread assertion via a mock-pool recorder, unregistered-pool rejection, and a reserve-sourcing regression (POOL_STATE diverged from balances).

Ops hardening from the same testing:

• expand-economy rejects instantiation with factory_address equal to the instantiating wallet — the placeholder misconfiguration that deferred every threshold-crossing reward and costs a 48h timelock to repair (tested)
• scripts/verify_deploy.sh: post-deploy wiring verification (expand <-> factory cross-check, expand funding, router factory binding, and the oracle canary with staleness warning)
• keepers: distribution/notify watcher now auto-discovers commit pools from the factory's pools registry query when POOL_ADDRESSES is unset; discovery failures keep the last good watch list (tested)
• RUNBOOK.md: production operations guide with timing constants quoted from source (UPDATE_INTERVAL=60s, pool staleness gate=120s, Pyth age cap=300s — keeper cadence 65-75s), the three recurring oracle-pipeline jobs, event-driven duties, deploy order, the fail-closed canary probe, alert list, and reference topology

Workspace suite: 661 tests passing.

https://claude.ai/code/session_01PBHdD9Wpt5rB8eUCWQHzVw