feat: wire TezFinOracle to TezOracle views and keep risk ops fail-closed

[AK-APRIORIT]

Summary

Closes item 8 for the TezOracle N-of-M work. TezFinOracle no longer rewrites XTZ-USD into Harbinger XTZUSDT. It maps market names through an explicit, versioned alias table onto TezOracle canonical IDs and keeps consumer freshness/bounds in TezFin.

Upstream TezOracle PR:

Pinned TezOracle commit: bc5ccb8162960a98b0676a7b5588465f219f2fdb

• Wrapper map: XTZ-USD → XTZ_USD, USDT-USD → USDT_USD, USD-USD → USDTZ_USD, TZBTC-USD → TZBTC_USD, BTC-USD → BTC_USD. WTZ / OXTZ / STXTZ still alias to XTZ-USD. Unknown names fail with ASSET_ID. Canonical keys cannot be remapped (TZBTC-USD cannot become BTC-USD).
• Calls TezOracle get_price_with_timestamp as (nat, timestamp) and returns (timestamp, nat) from getPrice / getValidatedPrice.
• Comptroller revalidates the oracle on every price update (no same-level cache skip), so pause in the same block cannot reuse a last-good price.
• mint / borrow / redeem / transfer / enter / exit / liquidation require a current validated price. repayBorrowAllowed has no oracle dependency.
• Tests cover missing, immature pending, global/per-asset pause, delayed unpause, stale/future/invalid/out-of-bounds/movement failures, distinct BTC vs tzBTC and USDT vs USDtz, Comptroller hooks, and exact CToken mint/borrow/transfer/liquidate vs repay.
• CI compiles against the pinned TezOracle Michelson ABI.

This does not point production Comptroller at a TezOracle origination anddoes not authorize mainnet set_oracle.