feat(zeronet): update Cobalt verifier hashes

[0xth4nh]

Summary

Updates the shared script/common/verifier-update/ scripts for the Cobalt AggregateVerifier, redeploys Zeronet's verifier with updated proof program hashes, and registers it for game type 621.

• every unchanged constructor value is copied from the previously registered verifier
• only TEE_IMAGE_HASH, ZK_RANGE_HASH, and ZK_AGGREGATE_HASH change
• DisputeGameFactory.setImplementation(621, newAggregateVerifier) updates new games without changing game args or existing games

New proof program hashes

Hash	Value
TEE image	0xb3d3746cf4b830046e9196dc196244d69fd96d3d436bd45ab84e35a9236f351f
ZK range verification key	0x776848834e7efcb029c48cf7215175b77098e8db28f27d2b074a64106f1c2b16
ZK aggregation verification key	0x002663a1072dc1e1938e13d3b269fff88e843eb4ef76d6c6953dde4f5152973b

Deployment and execution

• New AggregateVerifier: 0x90ab3A3a747a60EF56919574dA1766F20ACEe21C (deployment)
• Factory update: executed

Post-execution, gameImpls(621) returns the new verifier, gameArgs(621) remains empty, and every constructor immutable except the configured proof program hashes matches the previous verifier. The completed task and its deployment, approval, and execution records are archived under archive/evm/2026-09-16-update-cobalt-verifier-hashes/.

Testing

• forge fmt --check script/common/verifier-update
• forge build --force
• live Zeronet signing simulations for Coinbase and Security Council
• deployment creation bytecode plus constructor args matched the broadcast transaction input
• post-execution onchain state verified
• git diff --check

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 2/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 2 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 2 2 1 if commit is unverified 0 Sum 2

[linear]

CHAIN-5388

Approved review 5226785528 from roger-bai-coinbase is now dismissed due to new commit. Re-request for approval.