feat(svm): align toolchain with solana-v5 and remove event PDA searches

[Reinis-FRP]

The SVM workspace still used Anchor 0.31.1, including two runtime event-authority PDA searches per emitted CPI event. This upgrades all workspace programs and their tooling to the solana-v5 toolchain before the contracts audit, so the later repository migration can retain the reviewed compiler/dependency recipe.

Stacked on #1568 (reinis/svm-cu-benchmarks). Addresses #1571 through the framework upgrade; this is broader than a local event-CPI backport.

• Anchor CLI, Rust crates and JS clients: 1.1.2; development validator: Agave 4.1.2. Verified builds use solana-v5's digest-pinned Agave 4.0.3 / platform-tools 1.53 / arch v0 image and verifier 0.5.1. Cargo dependencies, enabled features and release profiles were compared against a prospective Spoke import into the destination workspace; all 149 resolved SBF dependency nodes match.
• Preserve Spoke's instruction/account metadata, serialized layouts, event schemas and all 55 existing V5-branch error codes. Consolidate each program's errors into one Anchor enum. Sponsored CCTP's previously overlapping errors become distinct 6000/7000/8000 ranges; existing deployed binaries are unchanged.
• Preserve mocked-clock/arbitrary-state-seed tests. Add a separate verified production-binary lane for real Clock behavior, seed-zero initialization, unavailable test entrypoints, and authenticated event self-CPI. Permit intentional aliases only in the test Gateway mock so Anchor's new duplicate-account guard does not bypass Spoke validation coverage.
• Migrate generated clients and operational helpers to @anchor-lang/core; use reviewed Circle V2 IDL snapshots. Restore canonical event-authority PDA metadata omitted by Anchor 1.1 so typed account resolution and Codama async builders retain their existing behavior. Update CI installation, build/cache inputs, locked builds and documentation.

The development validator and release compiler are separate pins. No solana-v5 compiler upgrade or program deployment is part of this PR. Include this framework/compiler/dependency diff in the upcoming audit scope; a later repository move still needs matching executable hashes from the final migration checkout. Upgrading Sponsored CCTP and multicall source does not require redeploying those retiring programs.

Validation:

• Guarded verified builds pass for all five test-feature programs and all four production programs, with no stack diagnostics. Production Spoke SHA-256: dc69f1ddf8e6c16b7bebd14a83d6a2dbc7e61420830684083a81692a4f4d3fda.
• Rust: 20 tests in each of default and test-feature configurations; workspace Clippy passes.
• Validator tests: the 130 unaffected cases passed in the full run; all 25 V5 source/fill cases pass after the test-mock alias fix. The separate verified production lane passes all 6 checks.
• Real Gateway/Raydium conformance and path vectors: 33 passing.
• Package build, final test typecheck, generated async-builder check, formatting, YAML parsing and repository commit hooks pass.
• Production IDL comparison preserves all 21 instruction/account metadata entries, 32 shared type schemas, 5 account discriminators, 12 event definitions and 55 Spoke error assignments. The restored PDA seed metadata is client-only; runtime authentication still uses Anchor's constant authority and signer check.

Three complete CU runs reproduce all 25 measurements, program binary/IDL hashes and runtime hashes exactly. All 15 V5 inner event self-CPIs fall from 5,119 to 520 CU. Relative to the same-runtime pre-upgrade base, each fixture saves:

Flow	Execution before (median)	After (median)	Saving per fixture
V5 deposit	73,516	63,610	9,906
V5 external fill	84,564	74,461	10,103
V5 in-place fill	91,841	81,731	10,110

Both generated runtime PDA searches are replaced by Anchor's compile-time event-authority constant. The measured inner-call saving is 4,599 CU; total execution savings also include other framework/compiler changes. Legacy and Gateway binaries, fixture inputs, upload policy and runtime/token-program hashes are unchanged. The reviewed snapshot and interpretation are in test/svm-gateway/cu/baseline.json and its README. These are test-feature local-validator measurements, not mainnet production budgets.

Raw before/after receipts and build logs are retained locally under target/cu-toolchain-before, target/cu-toolchain-after-1, target/cu-toolchain-after-2 and target/cu-toolchain-after-3.

---

Sent from Reinis Martinsons's Codex CLI Agent using gpt-6-astra 🤖