[contracts] Harden settlement and bridge event spine for FlowChain local L1

[FlowmemoryAI]

Objective

Build the contract-side settlement/event/bridge spine needed for test flows. Contracts support the local/private L1; they are not the L1 runtime.

Worktree

E:\FlowMemory\flowmemory-contracts on agent/full-l1-contracts.

Acceptance criteria

• BaseBridgeLockbox supports test deposits, replay protection, token allowlist, pause, per-deposit cap, deterministic event shape, and test-only withdrawal/release hooks where needed.
• Settlement/event contracts remain compact and emit stable events useful to indexer/verifier and bridge agents.
• Foundry tests cover bridge and settlement edge cases, unauthorized access, pause/cap behavior, and replay attempts.
• Anvil/Base Sepolia script paths are dry-run by default and require explicit env values before broadcast.
• Event schemas are documented for bridge relayer handoff.
• Checks include forge test, npm run contracts:hardening, bridge-specific Foundry tests if added, and git diff --check.

Out of scope

Implementing the private runtime in Solidity, production Uniswap v4 hook deployment, tokenomics, production bridge, and broad mainnet release claims.