refactor: resolve critical production Sonar findings

[ty-everett]

What changed

• replace the SDK Tonelli–Shanks loop-header mutation with an equivalent explicit while loop
• remove the no-op void expression from the default MasterCertificate revocation callback while preserving its signature and return value
• extract overlay script-mode input lookup from the nested callback without changing storage ordering, concurrency, error isolation, or notification data
• add focused regressions for the complete script-mode spend notification payload and every input-identification branch (direct TXID, source-transaction fallback, and nonmatching input)
• advance the source candidate versions for @bsv/sdk and @bsv/overlay to 2.2.2 and synchronize governed documentation/health metadata

Why

This resolves the three non-complexity critical Sonar findings in production source on current main (typescript:S1994, typescript:S3735, and typescript:S2004) with behavior-preserving changes. The remaining blocker/bug-class findings are test-only and remain in the explicitly deferred QA phase of #324.

Impact

There are no protocol, API, deployment, CORS/CSP, dependency-range, or storage-semantic changes. The package versions are candidate source versions only: this PR does not publish packages, create tags, or create releases.

Validation

• full workspace build
• full workspace tests
• root lint, typecheck, and format checks
• SDK focused tests: 44/44
• overlay focused tests: 47/47
• SDK coverage: 146 suites / 5,744 tests
• overlay coverage: 7 suites / 88 tests; all branches on the changed helper covered locally
• pnpm audit:security: no known vulnerabilities
• SDK and overlay pack:check
• pnpm health:check: 58/58 governance tests, zero findings/control errors
• generated stack facts and parity matrix checks
• compiled documentation examples: 8 examples / 21 exact package tarballs
• conformance: 74 files / 6,650 vectors
• reproducible OpenAPI code generation: 9 files current
• git diff --check

Part of #324.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer review of exact head bdf5a22 against base 5f1f5d5: the SDK loop and default-callback changes are behavior preserving; the overlay extraction preserves notification payload, storage ordering, concurrency, and error isolation. The direct-TXID, source-transaction fallback, and nonmatching-input paths are covered. All 57 exact-head checks pass, including CodeQL, Sonar (0 new issues/hotspots), Codecov (all modified coverable lines covered), dependency review, Socket, artifact checks, coverage, platform checks, and mutation gates. No package, tag, or release is created by this PR. GitHub prohibits a PR author from formally approving their own PR, so this exact-SHA COMMENT records the completed ty-everett review before authorized admin merge.