feat(deploy): CREATE2 deterministic deploy script

Single Deploy.s.sol covering all four target chains (Arbitrum One,
Arbitrum Sepolia, Base mainnet, Base Sepolia). The Manager deploys via
CREATE2 through Arachnid's deterministic deployer (0x4e59...) using
salt keccak256('MiTanda.v1.Manager'), giving the same Manager address
on every chain — branding/UX win.

Structure:
- Pre-flight checks (deployer/treasury/subscription non-zero, gas lane
  non-zero, Arachnid present on this chain) fail loud before broadcast
- Predict Manager address via pure RLP encoding helper
- Deploy Tanda implementation, three NFTs (with predicted Manager
  address), then Manager via CREATE2
- Assert deployed Manager address matches prediction
- Critical ordering: manager.acceptOwnership() runs BEFORE any
  owner-only setup (allowlistToken, registerCollection, setActiveCollection),
  structurally enforced by being inside the same function with a
  require(manager.owner() == deployer) gate between
- 13 post-deploy invariant checks before considering deploy successful
- JSON output to deployments/{chainId}.json for frontend consumption
- Logged post-deploy instructions (add Manager as VRF consumer, fund
  subscription, verify contracts on block explorer)

Chain config:
- Base mainnet and Arbitrum One gas-lane keyHashes filled (best-effort
  from training data, marked VERIFY against Chainlink docs)
- Base Sepolia and Arbitrum Sepolia gas-lane keyHashes left as bytes32(0)
  with TODO comments; pre-flight reverts until set
- Token allowlists per chain: USDC on Base, USDC+MXNB on Arbitrum One,
  MXNB on Arbitrum Sepolia (no canonical Sepolia USDC), USDC on Base Sepolia

.env.example documents all required environment variables including
the cross-chain determinism contract (fresh deployer EOA, same starting
nonce on each chain, no intervening transactions).

85 tests still pass; no contract changes in this commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: GeObts

.env.example

@@ -1,17 +1,60 @@
 # Mi Tanda — environment template
 # Copy to .env and fill in. NEVER commit the real .env.
 
-# ===== Alchemy RPC endpoints =====
+# ─────────────────────────────────────────────────────────────────────
+# Alchemy RPC endpoints
+# ─────────────────────────────────────────────────────────────────────
 ARBITRUM_MAINNET_RPC_URL=https://arb-mainnet.g.alchemy.com/v2/<YOUR_ALCHEMY_KEY>
 BASE_MAINNET_RPC_URL=https://base-mainnet.g.alchemy.com/v2/<YOUR_ALCHEMY_KEY>
 ARBITRUM_SEPOLIA_RPC_URL=https://arb-sepolia.g.alchemy.com/v2/<YOUR_ALCHEMY_KEY>
 BASE_SEPOLIA_RPC_URL=https://base-sepolia.g.alchemy.com/v2/<YOUR_ALCHEMY_KEY>
 
-# ===== Privy =====
+# ─────────────────────────────────────────────────────────────────────
+# Privy
+# ─────────────────────────────────────────────────────────────────────
 PRIVY_APP_ID=<your-privy-app-id>
 PRIVY_APP_SECRET=<your-privy-app-secret>
 
-# ===== Deployment =====
+# ─────────────────────────────────────────────────────────────────────
+# Deployer
+#
+# Cross-chain determinism note: the Manager's CREATE2 address depends
+# on (deployer EOA, deployer nonce, salt, init code). To get the SAME
+# Manager address on every chain, use a FRESH deployer EOA dedicated
+# to Mi Tanda deploys and run the script with the same starting nonce
+# on each chain (ideally nonce 0 — i.e. the EOA has never sent any tx
+# on that chain). Do not reuse the deployer between chain runs.
+# ─────────────────────────────────────────────────────────────────────
 DEPLOYER_PRIVATE_KEY=0x<your-deployer-private-key>
+
+# ─────────────────────────────────────────────────────────────────────
+# Block explorer API keys — for `forge verify-contract`
+# ─────────────────────────────────────────────────────────────────────
 ARBISCAN_API_KEY=<your-arbiscan-api-key>
 BASESCAN_API_KEY=<your-basescan-api-key>
+
+# ─────────────────────────────────────────────────────────────────────
+# Treasury (platform fee recipient + initial royalty receiver)
+# Owner-configurable post-deploy via TandaManager.setTreasury(...)
+# ─────────────────────────────────────────────────────────────────────
+TREASURY_ADDRESS=0x70D3a9aA7e10070d3F528e91c9bCf5158c922C66
+
+# ─────────────────────────────────────────────────────────────────────
+# Chainlink VRF v2.5
+# Create the subscription per-chain at https://vrf.chain.link
+# Fund it with native ETH (not LINK) — the deploy script logs the
+# `fundSubscriptionWithNative` cast command in its post-deploy steps.
+# ─────────────────────────────────────────────────────────────────────
+VRF_SUBSCRIPTION_ID=
+
+# 2.5M gas accommodates the worst-case 50-participant shuffle plus
+# coordinator callback overhead with margin. Owner can adjust via
+# TandaManager.updateVRFConfig(...) post-deploy.
+CALLBACK_GAS_LIMIT=2500000
+
+# ─────────────────────────────────────────────────────────────────────
+# Initial Receipt NFT fallback URI — used when a tanda has no
+# sponsored collection active. Set to your IPFS CID for a tasteful
+# default; owner can update later via MitandaReceiptNFT.setDefaultFallbackBaseURI.
+# ─────────────────────────────────────────────────────────────────────
+INITIAL_FALLBACK_BASE_URI=ipfs://QmReplaceWithRealCID

deployments/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore