feat(grc20reg): add transaction wrappers for registered tokens

[notJoon]

Description

Add Transfer, TransferFrom, and Approve wrappers to grc20reg. These functions let callers interact with any registered
GRC20 token through its registry key without importing the token realm directly.

Authorization

Each wrapper validates the live crossing frame with cur.IsCurrent() and rejects spoofed realm values with
grc20.ErrSpoofedRealm.

CallerTeller derives the account or spender from cur.Previous().Address():

• Direct calls operate on the user’s account.
• Cross-realm calls operate on the calling realm’s account.

Register now performs the same frame validation before deriving the registry key.

Potential adopters

• atomicswap: can replace its manual registry lookup and RealmTeller transaction flow.
• disperse: can support arbitrary registered tokens instead of factory-specific symbols.
• gov/dao/v3/treasury: could route registry-backed token sends through this wrapper if its banker boundary is adjusted.

Testing

Added unit coverage for user and realm transfers, approvals, allowance spending, and failed transfers.

[Gno2D2]

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Maintainers must be able to edit this pull request (more info)
🟢 Pending initial approval by a review team member, or review from tech-staff

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Automated Checks

Maintainers must be able to edit this pull request (more info)

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 The pull request was created from a fork (head branch repo: notJoon/gno-core)

Then

🟢 Requirement satisfied
└── 🟢 Maintainer can modify this pull request

Pending initial approval by a review team member, or review from tech-staff

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Not (🔴 Pull request author is a member of the team: tech-staff)

Then

🟢 Requirement satisfied
└── 🟢 If
    ├── 🟢 Condition
    │   └── 🟢 Or
    │       ├── 🟢 User davd-gzl already reviewed PR 5962 with state APPROVED
    │       ├── 🔴 At least 1 user(s) of the team tech-staff reviewed pull request
    │       └── 🔴 This pull request is a draft
    └── 🟢 Then
        └── 🟢 Not (🔴 This label is applied to pull request: review/triage-pending)

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission

[moul]

Review note — MERGE-READY. Wrappers correctly forward the caller's authority: each write calls MustGet(...).CallerTeller().<Op>(0, cur, ...), and the teller derives the actor from cur.Previous().Address() (grc20reg's own frame) — so msg.sender semantics are preserved and the registry realm never gains authority to move tokens it doesn't own. assertCurrent(cur) + the teller's own IsCurrent() double-check the frame. No banker/OriginSend involved. The cross-call test proving the calling realm's balance is debited (not the registry's) is the right proof.

Non-blocking warning:

• Test gap — no negative test for the assertCurrent/ErrSpoofedRealm path or unknown-token MustGet panic. Since the whole safety story rests on the frame assertion, a spoofed-realm negative test would be worth adding.

ℹ️ I merged latest master into this branch to clear the stale gas/testdata CI failures (govdao_proposal_change_law, wugnot, storage_deposit_price_change — all fixed upstream). Also interacts with #5907/#5908 (grc20 ID/key format) — coordinate merge order.

_{🤖 Posted autonomously by an AI review agent on @moul's behalf; not human-reviewed before posting.}