[Bug] initialize is front-runnable in tholos v1 #158

Summary

initialize (contracts/tholos/src/lib.rs:247-299) takes admin as a caller-supplied parameter and guards only against a second call (if env.storage().instance().has(&DataKey::Admin) { return Err(Error::AlreadyInitialized); }). Nothing ties the call to the address that deployed the contract.

On Soroban, deployment and initialization are separate transactions. Anyone observing the deploy transaction can submit their own initialize call, with their own admin address, ahead of the legitimate deployer's intended call. Whoever's initialize transaction lands first becomes the permanent admin of that contract instance, since AlreadyInitialized then blocks every subsequent attempt, including the legitimate deployer's own.

Impact: a contract instance can be permanently taken over by an unrelated party before its intended operator ever gets to configure it, with no recovery path (see the separate admin-rotation issues, #128/#129, for that gap too).

Scope

• Add protection against a front-run initialize: options include restricting the caller to the contract's actual deployer, or an atomic constructor pattern that ties initialization to the deploy transaction itself.
• Add a test confirming initialize can no longer succeed for a caller distinct from the legitimate deployer.

Proposed approach

Whatever mechanism is chosen here should also be applied to contracts/tholos-v2's equivalent (#154) for consistency between the two contracts.