fix(grc20reg): prevent token path overwrite and aliases

[notJoon]

Description

Related to gnoswap-labs/gnoswap#1334

This PR makes grc20reg.Register use canonical token registrations.

Previously, registry keys were built from the caller provided slug as the registry key and wrote with registry.Set, allowing existing token paths to be overwritten and the same token identity to be registered under multiple aliases.

The new behavior:

• derives registry keys from the registering realm path and token symbol, matching token.ID()
• rejects nil tokens and tokens from a different realm
• prevents overwriting existing registry keys
• prevents alias-style alternate lookup keys
• emits canonical token_path and symbol in register events

Tests and atomicswap examples were updated to use canonical token paths.

[Gno2D2]

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Maintainers must be able to edit this pull request (more info)
🟢 Pending initial approval by a review team member, or review from tech-staff

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Automated Checks

Maintainers must be able to edit this pull request (more info)

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 The pull request was created from a fork (head branch repo: notJoon/gno-core)

Then

🟢 Requirement satisfied
└── 🟢 Maintainer can modify this pull request

Pending initial approval by a review team member, or review from tech-staff

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Not (🔴 Pull request author is a member of the team: tech-staff)

Then

🟢 Requirement satisfied
└── 🟢 If
    ├── 🟢 Condition
    │   └── 🟢 Or
    │       ├── 🟢 User davd-gzl already reviewed PR 5907 with state APPROVED
    │       ├── 🟢 At least 1 user(s) of the team tech-staff reviewed pull request
    │       └── 🔴 This pull request is a draft
    └── 🟢 Then
        └── 🟢 Not (🔴 This label is applied to pull request: review/triage-pending)

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission

[davd-gzl]

This should be rebased on #5908.

[moul]

Review note — MERGE-READY. The fix is sound: Register keys off token.ID() (bound unforgeably at grc20.NewToken under IsCurrent()), enforces key == token.ID(), and blocks overwrite via registry.Has(key) and aliasing by removing slug from key construction. Auth model correct (crossing fn, cur.Previous().PkgPath()), determinism fine (avl.Tree). Good negative tests.

Two non-blocking warnings:

1. slug is now effectively dead — validated and emitted in the register event but never influences the key or storage. Callers still pass slugs that are silently ignored for lookup, and the event carries a slug attr that no longer maps to anything retrievable. Consider deprecating/removing it or documenting that it's cosmetic.
2. Breaking key-format change for tokens previously registered with an empty slug (bare pkgPath → pkgPath.SYMBOL). In-repo consumers are all migrated; any off-repo/on-chain Get(pkgPath) breaks. Worth calling out as intentional in the description.

⚠️ Cross-PR interaction with #5908: that PR changes Token.ID()'s format (adds a seqid component). Since this PR's registry key derives from token.ID(), merge order matters — whichever lands second needs a rebase and a re-check that keys still resolve.

_{🤖 Posted autonomously by an AI review agent on @moul's behalf; not human-reviewed before posting.}