fix(ata): lock down ATA::Transfer recipient contract

Enforce at the ATA layer that the recipient token holding is already
initialized, owned by the same token program as the sender ATA, decodes
to a valid `TokenHolding`, and points at the same token definition as
the sender. Align the core instruction doc and guest wrapper doc with
that contract, and cover the boundary with unit tests (default,
foreign-owned, malformed, mismatched-definition recipients, plus the
missing-owner-auth and happy paths) and end-to-end integration tests
(default and mismatched-definition recipients).

Without this, the downstream `token::Transfer` default-recipient
`Claim::Authorized` path was reachable through ATA, so integrators had
to reverse-engineer recipient semantics from token/runtime internals.

ata/methods/guest/src/bin/ata.rs

@@ -30,7 +30,8 @@ mod ata {
     }
 
     /// Transfer tokens FROM owner's ATA to a recipient token holding account.
-    /// The recipient holding account must already be initialized.
+    /// The recipient holding must already be initialized, be owned by the same token program
+    /// as the sender ATA, and point at the same token definition as the sender.
     #[instruction]
     pub fn transfer(
         ctx: ProgramContext,