feat(mainnet): add Cobalt rollout after ProtocolVersions deployment

[0xth4nh]

Summary

Adds the Base mainnet Cobalt rollout on top of the finalized Sepolia rollout and archived ProtocolVersions deployment.

For mainnet, make TASK_NETWORK=mainnet deploy runs the complete deployment sequence in order:

1. Cobalt core implementations
2. Cobalt proof implementations
3. P384Verifier, CertManager, and NitroValidator
4. hinted TEEProverRegistry implementation

The six-call Safe transaction:

1. raises ProtocolVersions.minimumProtocolVersion from v1.4.1 to v1.4.2
2. upgrades OptimismPortal2
3. upgrades the stock SystemConfig to v3.14.0
4. upgrades DisputeGameFactory
5. registers the Cobalt AggregateVerifier
6. upgrades TEEProverRegistry to the hinted Nitro implementation

The existing Cobalt activation timestamp (1790791200, September 30, 2026 at 18:00 UTC) and schedule commitment remain unchanged. The script snapshots scheduleId() before execution and reasserts it afterward.

v1.4.2 proof hashes

Program	Hash
TEE image	0x45c538bc396fe4a01b3f9ddc999494c3b993480ecac0a917e2f1af230d78b0e0
ZK range	0x25e035df08601f4b0b862be24c4bd08b1ee0524623fe737e7e8e378458ec7c21
ZK aggregation	0x00f500229b99db6a14c508c444e4527793f2f178168847acf3f755118614568a

Mainnet retains task-origin validation and the task-creator, Base facilitator, and Security Council facilitator signature flow.

Validation

• clean forge build
• live mainnet current minimum confirmed as v1.4.1
• v1.4.2 packed value re-derived as 79228162588051313896972091392
• all three supplied hashes are valid bytes32 values and differ from the live verifier
• mainnet deployment dry run confirms core → proofs → Nitro stack → TEE registry order
• forge fmt --check
• git diff --check

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 2/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 2 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 2 2 1 if commit is unverified 0 Sum 2

[mw2000]

Only change looks like accounting for the fact that ProtocolVersions contract was previously deployed and we are reusing that.

LGTM

Approved review 5281874135 from mw2000 is now dismissed due to new commit. Re-request for approval.