Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim() (CVE-2026-55658) | HOL Guard CVE