INK Finance Treasury Drain via Address-Only Payroll Claimer Authorization

The attacker used a Balancer V2 flash loan to pre-fund the treasury, then called `claimPayroll(3)` from an attacker-controlled contract that passed address-only claim authorization and triggered the treasury transfer path.