refactor+docs+schema: OAV context injection and address patterns

[ajag408]

Summary

• Document that callers should always pass project OAVs in context (additive; baked vault-registry.json is not the freshness gate) and that context is trusted control-plane data, never from the user or the tx.
• Document that allocatorVaultInputTokenAddress is required for injected-OAV APPROVAL.
• Tighten Ajv pattern: '^0x[0-9a-fA-F]{40}$' on allocatorVaultAddress and allocatorVaultInputTokenAddress; handler tests accept valid hex and reject not-an-address with SCHEMA_VALIDATION_ERROR.

QA Proof

What Needs to Be QA'd in Staging

• CLI/JSON validate with valid context.feeConfiguration[].allocatorVaultAddress + allocatorVaultInputTokenAddress still succeeds (schema layer)
• allocatorVaultAddress: "not-an-address" returns SCHEMA_VALIDATION_ERROR (does not run the yield validator)
• Injected-OAV APPROVAL / SUPPLY / WITHDRAW behavior unchanged from base PR (token required only for approval)
• README: no instruction to use GitHub main vault-registry.json as the OAV allowlist

QA Team Notification

• QA team has been notified to test in staging

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.