[deploy] Post-deploy: Basescan verification + hook-address sanity check + addresses.json export

[ozpool]

Context

Post-broadcast hardening. Every contract verified on Basescan; hook address bits asserted match bytecode.

Ref: PRISM_PRD_v1.0.html §Day 7.

Scope

In scope:

• scripts/verify-hook.ts — asserts address bits vs getHookPermissions()
• Automatic Basescan verification for every deployed contract
• packages/shared/src/addresses.ts updated with deployed addresses

Out of scope:

• Anything not listed above.

Acceptance Criteria

• All contracts show 'verified' on Basescan
• Pinned toolchain versions (Node / Foundry / pnpm)
• No secrets in workflows or committed files
• Pre-merge gate as applicable (forge test, Slither, Aderyn, typecheck, lint)
• Status checks required on default branch where relevant
• Rollback path documented

Dependencies

• Blocks: [frontend] Vault list page: data fetching + VaultCard components + link to detail #49, [frontend] Vault detail page layout: header + TVL/APR/share-price metrics + positions table #50
• Blocked by: [contracts] HookMiner: CREATE2 salt mining until address & 0x3FFF == 0x05C0 #25, [deploy] Deploy.s.sol: Vault + VaultFactory + BellStrategy + ProtocolHook + ChainlinkAdapter wiring #64

References

• N/A

Estimate

M