Block same-timestamp Predict mint and redeem (DBU-472)

[sdelo]

Summary

• Record each open position's on-chain open time (clock.timestamp_ms()) at mint, stored on the per-account Position row in predict_account.
• Reject a live redeem (expiry_market::redeem_live -> redeem_live_internal) whose timestamp equals the position's open time (EMintRedeemSameTimestamp). A single transaction reads one Clock, so equal timestamps mean the mint and redeem are in the same atomic transaction.
• This closes the atomic mint -> update oracle -> redeem arbitrage: a freshly minted order can no longer be round-tripped against a price the same transaction just pushed.

Key decisions

• Ownership split: predict_account owns the open-time state and exposes a position_opened_at_ms getter; expiry_market::redeem_live_internal owns the redeem policy and does the != assertion (EMintRedeemSameTimestamp).
• The open time is carried forward unchanged across partial-close replacements (not reset to the close time). The same-timestamp guard runs before any replacement is created, so a freshly minted order can never produce a replacement in its own mint tx; carry-forward only ensures a seasoned position stays closable in multiple steps within one later tx (an "orders always closable" liveness property), with no security difference vs. resetting.
• The guard applies only to the live-priced close. The liquidated-tombstone and settled-redeem paths are not gated: liquidation requires the order to be underwater (a freshly minted order passes the at-entry barrier) and pays zero, and settled redeem is post-expiry, so neither can be the same-tx counterpart of a mint.
• Comparison is != (the clock is monotonic non-decreasing, so this is equivalent to "the clock must have advanced").

Test plan

• sui move build --path packages/predict --warnings-are-errors is green.
• sui move test --path packages/predict --gas-limit 100000000000 is green (238 tests).
• predict_account_tests: position_opened_at_ms round-trips the stored open time (including carry-forward across a partial-close replacement) and aborts EPositionNotFound for an unknown order.
• Integration coverage in tests/flows/mint_redeem_guard_tests.move.disabled (same-tx redeem aborts EMintRedeemSameTimestamp; redeem succeeds once the clock advances). It is committed .disabled to match the rest of the root-dependent flow suite, which cannot run on the stable framework (no AccumulatorRoot test constructor); it should be re-enabled with them on the nightly framework.

[sdelo]

@claude review