feat(gnovm): add code_submission_policy vm param

[moul]

Summary

Implements Phase 1 of the code-submission permissioning design (gist).

• Adds code_submission_policy ("permissionless" | "permissioned") and code_submitters (address allowlist) to the vm module Params
• Adds checkCodeSubmissionPolicy in the ante handler: when policy is "permissioned", MsgAddPackage and MsgRun are rejected for any signer not on the allowlist — before typechecking runs, covering both CheckTx and DeliverTx
• Defaults to "permissionless"; existing chains and devnets are unaffected
• Updates pb3_gen.go with fields 14/15 for the new params (codec parity maintained)
• Updates the pinned TestAppHashCrossrealm38 hash (intentional consensus-state change)
• Adds ADR at gno.land/adr/prxxxx_code_submission_policy.md

Changes

• gno.land/pkg/sdk/vm/params.go — new CodeSubmissionPolicy type + fields, validation, WillSetParam cases
• gno.land/pkg/gnoland/app.go — checkCodeSubmissionPolicy function wired after session restrictions
• gno.land/pkg/sdk/vm/pb3_gen.go — amino codec fields 14 (policy string) and 15 (submitters repeated address)
• gno.land/adr/prxxxx_code_submission_policy.md — ADR

Test plan

• go test ./gno.land/pkg/sdk/vm/... passes
• go test ./gno.land/pkg/gnoland/... passes
• Manual: set code_submission_policy=permissioned + a submitter and verify unauthorized MsgAddPackage is rejected

[Gno2D2]

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

No automated checks match this pull request.

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission