[New Permission 5/5] smartcontract: enforce topology/resource/index permission flags

[juan-malbeclabs]

Permission rollout — stacked PR series. Review/merge order:

1. #3206 — enforce Permission-based authorization in existing instructions
2. #3942 — define topology/resource/index permission flags (3/4) — stacked on [New Permission 3/5] smartcontract: enforce Permission-based authorization in existing instructions #3206
3. #3943 — enforce topology/resource/index permission flags (4/4) — stacked on [New Permission 4/5] smartcontract: define topology/resource/index permission flags #3942

Retarget each PR's base to main as its upstream merges.
👉 You are here: #3943 (PR 4/4).

Summary

• Replaces the direct foundation_allowlist checks with authorize() in topology (create / delete / clear / assign-node-segments) → TOPOLOGY_ADMIN, resource (create / allocate / deallocate / close) → RESOURCE_ADMIN, and index (create / delete) → INDEX_ADMIN.
• The Permission account is read as the optional trailing account; the variable-length clear and assign-node-segments layouts detect it by PDA match before consuming their link/device lists.
• Backward compatible: with no Permission account the legacy foundation path still applies, so existing callers (controlplane, current SDK) keep working.
• Switches the corresponding SDK commands to execute_authorized_transaction so the payer's Permission PDA is appended when it exists onchain.

Behavior change: the topology instructions now reject unauthorized callers with NotAllowed (Custom(8)) instead of Unauthorized (Custom(22)), since authorize() is the single rejection path; affected tests updated.

Depends on the 3/4 PR (stacked).

Testing Verification

• New end-to-end test test_topology_create_with_permission_account_allowed: a non-foundation key holding TOPOLOGY_ADMIN creates a topology via its Permission account — exercises the new authorization path through a real processor.
• topology / index / resource / permission integration suites pass; topology error-code assertions updated Unauthorized → NotAllowed.

Reference: smartcontract/programs/doublezero-serviceability/PERMISSION.md