fix: F-2026-18194 | [Dual Defense] Unbacked Gas PRC20 Mint on INBOUND_REVERT via applyGasRefund

[0xNilesh]

Ports the existing develop fix (b425c5d0) onto audit-fixes.

Problem

applyGasRefund runs for every terminal outbound with no tx-type gate. INBOUND_REVERT outbounds are protocol-initiated — buildRevertOutbound populates GasFee/GasToken from UniversalCore.getOutboundTxGasAndFees as a relayer gas hint, but the user was never charged for the revert and nothing was burned via swapAndBurnGas.

When the observed GasFeeUsed came in below that hint, the "excess" was refunded through UniversalCore.refundUnusedGas → IPRC20.deposit → _mint, with no escrow or burn backing it. That mints unbacked gas PRC20 to a user who never paid, while they also recover their principal on the source chain.

Fix

Return early from applyGasRefund when TxType == INBOUND_REVERT — regardless of PC20/PRC20 or whether GasFee is set — since there is no user-paid budget to refund against.

Notes

• Cherry-pick of b425c5d0 from develop; original authorship preserved. audit-fixes predates it.
• Ships with TestInboundRevertGasNotRefunded (test/integration/uexecutor/gas_refund_test.go).
• Verified as a genuine regression detector: the test passes with the guard, fails with it removed, and passes again once restored.
• go test -tags="ledger test_ledger_mock test" ./x/uexecutor/... ./test/integration/uexecutor/... — all packages ok.