fix: prevent false positive return for guarding dao member store (#3121)

If we want to guard the MemStore by checking the active DAO realm,
m.daoPkgPath must first be assigned a realm package path; otherwise, the
isCallerDAORealm() method may return a false positive, failing to
protect the MemStore.

<!-- please provide a detailed description of the changes made in this
pull request. -->

<details><summary>Contributors' checklist...</summary>

- [ ] Added new tests, or not needed, or not feasible
- [ ] Provided an example (e.g. screenshot) to aid review or the PR is
self-explanatory
- [ ] Updated the official documentation or not needed
- [ ] No breaking changes were made, or a `BREAKING CHANGE: xxx` message
was included in the description
- [ ] Added references to related issues and PRs
- [ ] Provided any useful hints for running manual tests
</details>

---------

Co-authored-by: Miloš Živković <[email protected]>

examples/gno.land/p/demo/membstore/membstore.gno

@@ -205,5 +205,5 @@ func (m *MembStore) TotalPower() uint64 {
 // the API of the member store is public and callable
 // by anyone who has a reference to the member store instance.
 func (m *MembStore) isCallerDAORealm() bool {
-	return m.daoPkgPath == "" || std.CurrentRealm().PkgPath() == m.daoPkgPath
+	return m.daoPkgPath != "" && std.CurrentRealm().PkgPath() == m.daoPkgPath
 }

examples/gno.land/r/gov/dao/v2/dao.gno

@@ -13,6 +13,8 @@ var (
 	members membstore.MemberStore // the member store
 )
 
+const daoPkgPath = "gno.land/r/gov/dao/v2"
+
 func init() {
 	// Example initial member set (just test addresses)
 	set := []membstore.Member{
@@ -23,7 +25,7 @@ func init() {
 	}
 
 	// Set the member store
-	members = membstore.NewMembStore(membstore.WithInitialMembers(set))
+	members = membstore.NewMembStore(membstore.WithInitialMembers(set), membstore.WithDAOPkgPath(daoPkgPath))
 
 	// Set the DAO implementation
 	d = simpledao.New(members)