Huma Finance V1 Deprecated Pools Requested-to-GoodStanding Credit Lifecycle Drain

An attacker-controlled borrower opened credit requests with preApproved=false, then used a separate refreshAccount(address) transaction to move those Requested records into GoodStanding. The attacker then called drawdown(uint256) on three deprecated pools and swept the residual USDC/USDC.e balances.