Custom Registry generation 2 release candidate

[programmable-infra]

Release-candidate scope

Adds the provider-neutral Custom Registry generation 2 contracts, exact artifact/ABI/event verification, generation-aware read-model projection, and Website Developer Docs parity. Generation 1 and public v1 compatibility remain preserved.

This is a draft release candidate. It does not deploy contracts, enable public submissions, promote Production, or claim a generation 2 canary.

Safety bindings

• exact repository/source/build/artifact/runtime/configuration/deployment bindings
• exact raw event topics/data/log-order evidence
• atomic deployment evidence and provider factory authorization/source binding
• unknown-provider and unknown-template support without a client allowlist
• project-only and zero-market launches without invented token/pool/trading data; provider attribution stays in the launch registration while the onchain no-market fee tuple remains zero
• native 10 BPS policy and partner-template 20 BPS inclusive policy (15 partner / 5 Programmable, no extra 10)
• observed/confirmed/finalized/orphaned lifecycle and reorg handling
• v1 and Registry generation 1 remain frozen and compatible

Local validation

• npm run verify: 2,244 passed, 7 skipped, 0 failed; build/typecheck/lint successful
• npm run db:test:pglite: all SQL suites passed
• pinned pnpm 10.32 indexer: audit clean, codegen/typecheck, 81/81 tests
• npm run contracts:verify:ci: 687 deterministic, 125 mainnet-fork, 16 Sepolia-fork tests
• cross-stack project-only calldata regression: Approval and the public Solidity verifier agree on zero no-market fee attribution
• generation 2 artifact mutation suite: 9/9
• npm run contracts:slither: exit 0 (informational findings retained for review)
• direct gitleaks scan of the exact PR range: no leaks
• transitive @uniswap/v3-staker OpenZeppelin dependency patched from the critical <3.4.2 range to 3.4.2-solc-0.7; reproducible npm ci and the full verify gate pass, with the remaining 20 npm-audit findings low and unpatched upstream
• Developer Docs desktop/mobile, copy, keyboard/focus, console, reduced-motion and overflow QA completed

Deliberate release blockers

• no detached Command Center release record or candidate-specific Production promotion approval
• no deployed and explorer-verified generation 2 contracts
• no generation 2 unknown-template onchain canary
• publicSubmissionsEnabled remains false
• partner recipient/runtime evidence for named partner templates is not asserted without exact source/onchain proof