chore: add evm-v0.6.2 upgrade handler (donut)

[0xNilesh]

Adds the named upgrade plan for the cosmos/evm v0.6.0 → v0.6.2 binary that landed on
testnet/donut in #353.

Why it is a no-op handler

Across v0.6.0..v0.6.2 upstream changed no .proto file, added or removed no store key, and bumped
no module's ConsensusVersion. So StoreUpgrades is empty and RunMigrations is expected to do
nothing. The plan exists purely so cosmovisor has a name to switch the binary on at a height — same shape
as the existing evm-v0.6.0 handler, minus its transfer v5→v6 migration (which was specific to that
release).

RunMigrations is still called rather than skipped, so the stored version map stays consistent and any
migration bundled by a dependency runs instead of being silently dropped.

Behavioural changes carried by this binary

Documented in the handler's doc comment so it is discoverable from the code, not just the PR:

1. SubBalance now panics on balance underflow instead of wrapping silently — upstream's equivalent of
   our F-2026-18201 statedb fix (x/vm/statedb/state_object.go; the diff is byte-identical to our evm Enable connecting with local node to read chains config #40).
   A panic fails the tx, it does not halt the chain. Anything currently underflowing silently would begin
   failing visibly.
2. Module accounts may no longer have their EVM balance written (v0.6.1 security merge 3524ebc6).
   Push is unaffected — verified:
   • every module-sender EVM call passes value=0, so the module's EVM balance is never written
   • DeductAndBurnFees uses SendCoinsFromAccountToModule (SDK bank keeper), which never enters the EVM
     statedb path
   • universal-validator reward distribution (x/uvalidator/abci.go) is SendCoinsFromModuleToModule +
     AllocateTokensToValidator on bankkeeper.BaseKeeper / distribution keeper — also outside the EVM.
     This one matters because it runs in BeginBlocker every block.
   • the inbound CallExecuteUniversalTx + DeductGasFeesFromReceipt combination is exercised by
     TestInboundCEAGasAndPayload / TestInboundCEAFundsAndPayload with 0 occurrences of
     not allowed to receive funds
3. Precompile out-of-gas propagates as vm.ErrOutOfGas — different error on calls already running out
   of gas. No repricing; succeeding transactions consume identical gas.
4. No-ops on this chain: extended-denom accounting (donut sets ExtendedDenom == Denom == upc, and the
   new code is guarded on the denoms differing) and the erc20 IBC v2 ack changes (no IBC v2 stack is wired).

Verified locally

• go build ./app/... clean
• go test ./app/... green
• 41 handlers registered (was 40), evm-v0.6.2 among them
• no duplicate UpgradeName across all handlers

Next

Localnet upgrade simulation across the height before the governance plan.