select_winners: use saturating arithmetic for the anchor index (Scout finding)

[0xdevcollins]

Source: docs/threat-model.md v1.0, Tamp.7 (planned hardening). Scout re-scan S-1.

contracts/events/src/event_ops.rs:745: let anchor_idx = existing_count + (idx as u32); is the one bare addition left in the contract. Unreachable in practice (2³² winner records) and it traps under overflow-checks = true, but it breaks the checked-arithmetic rule adopted for the earlier Scout findings.

• existing_count.saturating_add(idx as u32)
• Re-run Scout (see docs/scout-audit-report.md for the SDK 23.5 workaround) and confirm the finding is gone

[abojeEdwin]

Hi maintainer, I've gone through the issue and I have a clear understanding of the fix for this issue. I'd love to be assigned to this issue. Thank you

[Joyful12-tech]

Hello Maintainer! I'd like to work on this issue. I can deliver it following the requirements and submit a quality PR within 2 days. Thank you!

[guptakumarranjeet150]

Hello! I would like to work on this issue.

I can tackle select_winners: use saturating arithmetic for the anchor index (Scout finding). Proposed implementation roadmap:

• Analysis: Inspect current behavior and edge cases in boundlessfi/boundless-contract
• Core Implementation: Structure Soroban contract handlers for select_winners: use saturating arithmetic for the anchor index (Scout finding) following project idioms and storage invariants.
• Quality Assurance: Add Soroban test cases checking unauthorized invocations, edge values, and state updates.

I can start working on this right away. Please assign!