Contract: Re-entrancy guard analysis

[wheval]

Summary

• Adds docs/security/REENTRANCY_ANALYSIS.md: analyzes execute()/execute_internal for re-entrancy risk against arbitrary target/protocol_address contracts. Finds the code is not checks-effects-interactions ordered (the cross-contract call happens before the last_run state update), so the existing enter_security_guard/exit_security_guard global mutex is load-bearing, not redundant - confirmed necessary and sufficient rather than reordering writes.
• Bug found while tracing every guarded call path: execute_internal's yield-strategy branch called the guarded public execute_yield_strategy() for any task with a yield_strategy configured. Since execute() already holds the lock at that point, this immediately re-entered enter_security_guard and panicked - meaning any task with a yield_strategy set could never execute successfully, and this had zero test coverage (no existing test ever registered a task with yield_strategy: Some(_) and called execute()).
• Fixed the same way execute/execute_internal are already split: extracted a guard-free execute_yield_strategy_internal; the public execute_yield_strategy still guards itself as a standalone entry point, execute_internal now calls the internal helper directly so it shares execute()'s existing lock instead of trying to acquire a second one.
• Added test_execute_with_yield_strategy_does_not_trip_reentrancy_guard, exercising a yield-strategy task through the public execute() entry point end-to-end (real token, real keeper fee payment) - fails before the fix, passes after.

Closes #699

Test plan

• cargo test --lib in contract/ - all 136 tests pass, including the new regression test