fix(program): remediate escrow audit findings

[dev-jodee]

Summary

• remediate confirmed Creature audit findings refactor: post-review improvements and cleanup #2 through chore(deps): bump @solana/kit to v6.0.1 and related packages #14 in the escrow program
• harden account validation (version/discriminator checks, owner/mint checks, allowed mint self-validation)
• enforce extension and hook safety constraints, including signer rejection and withdraw context fixes
• fix prefunded-PDA create flow to avoid lamport transfer griefing while keeping strict create-once semantics
• defer finding #15 (receipt policy snapshot design) for a follow-up PR

Test Plan

• cargo fmt -p escrow-program -p tests-escrow-program --check
• cd program && cargo clippy --all-targets -- -D warnings
• cd tests && cargo clippy --all-targets -- -D warnings
• cargo test -p escrow-program
• cargo test -p tests-escrow-program

Notes

• just fmt fails at pnpm lint:fix due existing strict TypeScript lint errors in apps/web and examples/typescript unrelated to these Rust/program changes.