feat(router): freeze universal launch kernel v1

[programmable-infra]

Summary

• freezes the source-only Universal Router vNext kernel, nested-factory profile, and deterministic artifact
• completes the closed-runtime parser so statically reachable code after an INVALID data delimiter is still inspected
• rejects transient storage opcodes for stateless runtime bindings while preserving the existing provider baseline
• wires the exact Router vNext build, artifact, size, gas, and hash-bound coverage gates into CI
• resolves the locked compiler from Foundry's SVM cache when CI does not expose solc on PATH
• gives the fixed-block Classic fork the same bounded archive-provider fallback already used by Router V2 evidence

Reviewed compatibility lineage

• exact reviewed source: ea0e4424b886a0c1ae928fc73d62bd8e907b44cd
• reviewed source tree: 8c5e0822d7ff256cad3d9e0350c980473d36aecc
• compatibility artifact SHA-256: f9d110d2850c4934ba0c22493eaa9d0f090bee6f0e6a1339ee3002344da1065a
• independent review carrier: feat(router): reviewable typed adoption grant freeze #213 at d023079c061d43044dfd2dbe23d9cba34d72a12e
• merged Main identity: aad6c6e1e7b744129559c3064f395bd22b37426b
• feat(router): freeze typed adoption grant preflight #206 is a superseded duplicate and must not be merged

The former stacked base and main@aad6c6e1 are tree-identical. This branch was rebased with --onto main ea0e4424; all six Router commits are patch-identical by git range-diff. A seventh focused commit stores the two release scripts as inert 100644 blobs. An eighth release-only fix binds src/router_vnext/** to the artifact's 100-run compiler profile through Foundry compilation restrictions, so the unchanged protected Root build enforces EIP-170 without mixing builder-maintenance and Router paths.

Root cause

The runtime scanner stopped at the first INVALID delimiter. Solidity may place non-entry runtime sections after that delimiter, and a statically pushed JUMPDEST can make such a section reachable. The parser now queues those static destinations and checks the reachable control-flow segment without broadly parsing embedded data.

The first stacked CI run also reproduced an environment-only artifact failure: Foundry had installed solc 0.8.26 in its SVM cache, but no solc executable was on PATH. The generator now resolves the exact SVM or solc-select cache binary before PATH, rejects wrappers, and accepts only the official Linux AMD64 or macOS AMD64 0.8.26 release hash.

The Mainnet evidence run reproduced the same provider-only failure twice: Flashbots had pruned the fixed block and drpc returned free-plan timeouts. The Classic fork now uses the already trusted Tenderly archive fallback with the same bounded retry and backoff shape as the Router V2 fork gate.

Release state

This PR remains source-only and deployment-denied. It does not deploy contracts, bind an authority, register or activate a profile, write Website state, or migrate a consumer.

The frozen Authority V3 record remains predecessor evidence only. Deployment, Authority binding, activation, and consumer handoff require separate deployment-bound receipts.

Validation

• final HEAD: 5cb4f0c9769b420d5240d88c7b9a861fd3755ed1
• base: main@aad6c6e1e7b744129559c3064f395bd22b37426b
• tree: 28709a9112f421aabb1ca884bab2f40b1c6b4213
• focused Universal gate: 21 passed, 0 failed
• root CI suite: 204 passed, 3 environment-gated skips, 0 failed; 10,000-run fuzz and 1,000-run invariants
• gas snapshot: 204 passed, 3 skipped, 0 failed
• format, root build, artifact diff-check, model registry, release evidence, and documentation links: passed
• Universal kernel runtime: 23,925 bytes, 651-byte EIP-170 margin under config/router-vnext/foundry.toml
• trusted Public Intake unit suite: 217 passed, 1 Linux-only skip, 0 failed
• hash-bound coverage: 89.25% lines, 94.52% functions, 36.44% branches
• Router artifact SHA-256: d1b805b0b8165e28105fd331e358fba70c7c0be9db0dcee4023924b84dfcd250
• Standard Input SHA-256: 49bfc15a1ddedcdde4728cffa24b4520f80da0f3443df2b8a2e199fd9eb85527

The via-IR coverage job excludes the exact-runtime Universal suite because via-IR changes the runtime shape and exhausts the production-bounded runtime scanner. Those sources and their test are hash-bound, while the unchanged exact compiler profile runs the full 21-test gate separately.