feat: contributor account verification in multiple places

[ANISH-SR]

Summary of Changes

• Enforced contributor identity across instructions to ensure contributor_account.key == link.contributor_pk where appropriate.
• Preserved foundation/activator authority flows by introducing a payer_in_foundation guard:
  • Foundation-allowlisted payers bypass the contributor/link equality check in suspend, resume, and delete flows.
• Prevents contributors from suspending, resuming, deleting, or closing links they do not own.
• Establishes a consistent authorization invariant across all serviceability paths.
• Still supports privileged foundation and activator workflows without breaking existing operational flows.

Testing Verification

• Existing unit and integration tests passed after updates.

Closes #2213