Summary of Changes

• Completes the least-privilege (RFC-2) Permission-account migration for the two remaining serviceability handlers the feed oracle calls, so the oracle can operate on an ACCESS_PASS_ADMIN | USER_ADMIN Permission account instead of foundation_allowlist membership — least privilege for a hot, always-online key.
• UpdateMulticastGroupRoles: granting roles on another owner's pass is now an ACCESS_PASS_ADMIN operation, while removal-only cleanup stays USER_ADMIN (unchanged from [New Permission 3/5] smartcontract: enforce Permission-based authorization in existing instructions #3206). Splitting by operation preserves the deliberate "USER_ADMIN is removal-only here" contract and the exact historical NotAllowed / Unauthorized error variants.
• CreateSubscribeUser owner-override now accepts a USER_ADMIN Permission holder in addition to the sentinel and foundation. The Permission account is threaded through CreateUserCoreAccounts (None for plain CreateUser, which never overrides the owner).
• Both handlers disambiguate the optional trailing Permission account from the EdgeSeat feed/device accounts via split_trailing_permission (PDA match, not position), so Permission and Feed coexist unambiguously. This also fixes a latent ordering bug in create_subscribe's EdgeSeat feed wiring: the SDK's assemble_instructions always appends [payer, system, permission?] last, so the feed sits before payer/system, not after — only latent today because feed_pk is None everywhere.
• The Permission path carries no owns-it restriction, so a flag holder acts across owners — required for the validator-owned users and passes the oracle manages. The change is additive: every existing caller keeps its exact current authority.
• permission/audit.rs: corrects the NON_MIGRATED_SUBSYSTEMS text — the user-create owner override now honors USER_ADMIN via authorize() (foundation via the legacy mapping, Permission holders directly), leaving only the sentinel direct check un-migrated.

Context: RFC-2 (malbeclabs/infra#1764), malbeclabs/doublezero-shreds#517. The subscriber-allowlist handlers (Add/Remove MulticastGroupSubAllowlist) were migrated to authorize() upstream in #3982 while this branch was in review, so that half is dropped here; this PR completes the set for the subscribe/create-user surface, following the established authorize() + split_trailing_permission pattern with no new authorization helper.

Diff Breakdown

Overwhelmingly tests: the authorization logic itself is a small, additive change to three processors, with the bulk of the diff proving the new cross-owner Permission paths.

Testing Verification

• Added integration tests exercising the new Permission path for each wired handler, all proving the cross-owner (no owns-it) property:
  • test_subscribe_access_pass_admin_permission_allowed — an ACCESS_PASS_ADMIN holder (not owner/foundation/sentinel/feed) subscribes a user cross-owner.
  • test_create_subscribe_user_user_admin_owner_override — a USER_ADMIN holder creates a subscribe-user with owner != payer.
  • Preserved the [New Permission 3/5] smartcontract: enforce Permission-based authorization in existing instructions #3206 contract tests: test_subscribe_user_admin_permission_rejected (USER_ADMIN still cannot add roles) and test_unsubscribe_user_admin_permission_allowed (USER_ADMIN removal cleanup).
• Retained ACCESS_PASS_ADMIN coverage for the subscriber-allowlist path (test_multicast_subscriber_allowlist_access_pass_admin_permission) — the oracle's exact path, which serviceability: authorize multicast instructions via Permission accounts #3982 migrated without adding a test.
• Updated feed_metro_gate_test to the SDK-consistent account order (feed before payer/system); all 4 EdgeSeat metro-gate cases pass, confirming feed + the new Permission parsing coexist.
• Note: test_set_accesspass_refills_depleted_user_payer is a pre-existing failure on main (airdrop-refill balance assertion, unrelated to authorization) — confirmed it fails identically on a clean origin/main checkout.