[New Permission 2b/5] smartcontract: implement Permission account CRUD

[juan-malbeclabs]

PR 3 of 5. Review order: PR 1: scaffold → PR 2: authorize() → PR 3 (this) → PR 4 → PR 5.
This diff is against jo/permission-authorize.

Summary of Changes

• Fills in all five Permission processor stubs (create, update, suspend, resume, delete), replacing the Err(InvalidInstructionData) placeholders from the scaffolding PR with full implementations
• Each processor validates account layout, derives and checks the Permission PDA, and calls authorize() requiring PERMISSION_ADMIN; create additionally requires PERMISSION_ADMIN on the caller's own Permission account (or falls back to foundation allowlist)
• Adds PERMISSION.md: permission model reference, flag definitions, authorization rules, legacy mapping table, and CLI usage examples
• Adds tests/permission_test.rs: program-level integration tests covering the full CRUD lifecycle, authorization enforcement, and edge cases (double-create, suspend-then-resume, delete-when-suspended, unauthorized access)

Diff Breakdown

Category	Files	Lines (+/-)	Net
Core logic	5	+428 / -22	+406
Tests	1	+455 / -0	+455
Docs	1	+237 / -0	+237

Tests account for nearly half the diff — processor logic and test coverage are roughly balanced.

Key files (click to expand)

• smartcontract/programs/doublezero-serviceability/src/processors/permission/create.rs — validates PDA, checks for double-create, calls authorize(PERMISSION_ADMIN), writes Permission account on-chain
• smartcontract/programs/doublezero-serviceability/src/processors/permission/update.rs — replaces bitmask, calls authorize(PERMISSION_ADMIN)
• smartcontract/programs/doublezero-serviceability/src/processors/permission/suspend.rs — transitions Activated → Suspended
• smartcontract/programs/doublezero-serviceability/src/processors/permission/resume.rs — transitions Suspended → Activated
• smartcontract/programs/doublezero-serviceability/src/processors/permission/delete.rs — transitions to Deleting, reclaims lamports
• smartcontract/programs/doublezero-serviceability/tests/permission_test.rs — full lifecycle tests, authorization failure cases
• smartcontract/programs/doublezero-serviceability/PERMISSION.md — permission model reference

Testing Verification

• tests/permission_test.rs covers: create/update/suspend/resume/delete success paths, unauthorized caller rejection, double-create rejection, state transition invariants
• make rust-test passes with all new tests