TopUpDistributor.pullUp does not validate canonical token ordering, allowing migrators to call with swapped args and miss top-ups

Opus finding

TopUpDistributor.pullUp does not validate canonical token ordering, allowing migrators to call with swapped args and miss top-ups

• src/TopUpDistributor.sol:110-130

`topUp` stores data under canonical (token0 < token1) keys, but `pullUp` does NOT enforce this. If a migrator calls `pullUp(token1, token0, recipient)` (swapped) it silently returns (amount==0) without warning and without pulling up the top-ups. Top-ups remain stuck. There is no `require(token0 < token1)` validation. This silent no-op is a footgun.