fix(runtime): FIX-5 governability (pallet-sudo to Root) + FIX-2 StorageVersion (4 pallets)

Build + tests verde (exit 0, runtime 27 tests incl. sudo_pallet_index_12).
Verificacion adversarial ultracode (5 skeptics): 4 confirmed + 1 partial.

FIX-5 — governability (audit V2-CA1):
- pallet-sudo 43.0.0 wired Index 12 (workspace + runtime Cargo.toml + std).
- impl pallet_sudo::Config (RuntimeEvent/RuntimeCall/WeightInfo) en configs.rs.
- genesis: sudo key en los 3 presets — dev/local=Alice, mainnet=foundation_treasury
  (NO una dev key; el verificador confirmo que no hay backdoor critico).
- Da Root origin -> las dispatchables ensure_root de Governance (add/remove
  council, mark/unmark advisor, treasury_disbursement) dejan de ser
  no-invocables. Verificado extremo-a-extremo: sudo() despacha RawOrigin::Root,
  que es exactamente lo que ensure_root acepta.
- Sunset documentado (codigo + doc): sudo -> governance real (pallet-collective/
  referenda) ANTES de mainnet. Sudo key unica = riesgo de centralizacion
  aceptable solo como interim/testnet.

FIX-2 — lifecycle (audit V1-H2/V2-CA2):
- StorageVersion::new(0) + pallet::storage_version en los 4 pallets
  (provenance/fees/agent-identity/governance). Aditivo, in-code==on-chain==0,
  sin migracion forzada. Habilita migraciones futuras.

CAVEAT honesto (hallazgo high del red-team, NO defecto de FIX-5/FIX-2):
treasury_disbursement solo DECREMENTA un contador u128 (Treasury StorageValue),
NO mueve OGC real via pallet_balances. FIX-5 restaura la GOBERNABILIDAD (la
dispatchable es invocable), pero mover los 250M reales es FIX-6: anadir
type Currency al Config + T::Currency::transfer desde una cuenta-tesoreria
derivada (PalletId) + financiarla en genesis + test del free_balance. NO se
afirma "tesoreria descongelada de verdad" — solo "gobernabilidad restaurada".

PENDIENTE:
- FIX-2 AGI key recovery (rotate/revoke/active en agent-identity): diferido —
  necesita un DC de semantica de recovery #41 (single-sig vs multisig threshold,
  DID estable vs rota, recovery de agent_chain vacio). No se construye contra
  spec no-ratificada.
- pallet-sudo no en feature runtime-benchmarks (inerte hoy: el runtime no impl
  el Benchmark API). Follow-up con weights benchmarking.
- mainnet Foundation sudo key (FNDT placeholder): David ratifica la key real
  (multisig) pre-launch Q1 2027 (documentado).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/origin-chain-runtime/src/lib.rs

@@ -367,6 +367,15 @@ mod runtime {
     #[runtime::pallet_index(11)]
     pub type Revive = pallet_revive::Pallet<Runtime>;
 
+    /// Sudo pallet (FIX-5 governability per audit V2-CA1). Provee Root origin
+    /// para invocar las dispatchables admin de Governance (add/remove council,
+    /// mark/unmark advisor, treasury_disbursement — todas `ensure_root`, hoy
+    /// no-invocables) + descongela la tesorería 250M. Sunset canonical: sudo →
+    /// governance real (pallet-collective/referenda) ANTES de mainnet. Sudo key
+    /// interim = Foundation multisig humano (genesis).
+    #[runtime::pallet_index(12)]
+    pub type Sudo = pallet_sudo::Pallet<Runtime>;
+
     // Substrate pallet-identity DEFERRED canonical (decision empírica
     // 2026-05-21 documentada en configs.rs). pallet-identity 41.0.0 ReservableCurrency
     // compat work canonical hereda al custom `pallet_agent_identity` Phase 2.7
@@ -933,6 +942,15 @@ mod tests {
         assert_eq!(<crate::Revive as PalletInfoAccess>::name(), "Revive");
     }
 
+    #[test]
+    fn sudo_pallet_index_12_canonical_governability() {
+        // FIX-5: Sudo=12 (post Revive=11). Root origin para las dispatchables
+        // admin de Governance (audit V2-CA1). Sunset → governance real pre-mainnet.
+        use frame_support::traits::PalletInfoAccess;
+        assert_eq!(<crate::Sudo as PalletInfoAccess>::index(), 12);
+        assert_eq!(<crate::Sudo as PalletInfoAccess>::name(), "Sudo");
+    }
+
     #[test]
     fn revive_address_mapper_account32_returns_h160_canonical() {
         // AccountId32Mapper canonical: AccountId32 → H160 mapping deterministic.