[GrantFox][High] Guard network, account, and contract version before signing

Summary

Guard network, account, and contract version before signing

Why this matters

A user must not sign for the wrong network, account, or incompatible contract deployment.

Scope

Add preflight checks and a final transaction summary with explicit remediation actions.

Acceptance criteria

• Unsupported network blocks signing.
• Connected account and expected authority match.
• Contract version/expected network is checked.
• Switch failures never auto-submit.

Validation

Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.

Non-goals

• Typo-only, formatting-only, or documentation-only changes.
• Unrelated refactors or dependency upgrades.
• Weakening existing security, authorization, CI, or production safeguards.

Contributor application

Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.

PR requirements

Use a feature branch, include Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.

Reward-readiness

This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.

No files or tests are named in the issue. Start by tracing the existing signing flow and its network, account, and contract checks, then add regression coverage for the listed failure modes and run the repository CI checks. Done means unsupported or mismatched configurations block signing, switch failures never submit, and the final summary gives explicit remediation actions.