fix: emit certificate events on state transitions

[leopoldjoy]

Summary

• emit certificate revocation events only when the stored status changes
• retain idempotent authorized revoke and unrevoke calls
• make the demo helper private immutable to preserve EIP-170 deployability after the production change

Audit finding

Addresses external finding #9.

Tests

• forge fmt --check src test
• forge test --match-contract CertRevocationEventTest
• forge build --sizes --skip test --skip script