feat(build): dual-cluster Cargo features for compile-time program ID

Apply Pattern D from lazorkit-protocol PR #9: the embedded program ID
is now chosen by `--features mainnet` or `--features devnet`, with a
`compile_error!` if neither (or both) is set. Prevents accidental
cross-cluster deploys — a binary compiled with one ID malfunctions if
deployed to the other cluster's slot.

Mainnet feature embeds LazorjRFNavitUaBu5m3WaNPjU1maipvSW2rZfAFAKi —
the SAME program ID as lazorkit-protocol. program-v2 (foundation,
no-fee build) occupies that mainnet slot for the duration of the
foundation contract; at contract end the upgrade authority swaps the
binary at the same slot to lazorkit-protocol's commercial build.
dApp integrators keep one stable program ID through the transition.

Devnet feature keeps program-v2's existing FLb7fyAtkfA4TSa2uYcAT8QKHd2pkoMHgmqfnXFXo7ao.

Build verification:
  cargo build-sbf --features mainnet  →  sha differs from devnet
  cargo build-sbf --features devnet   →  sha differs from mainnet
  cargo build-sbf                     →  fails with compile_error
  cargo build-sbf --features mainnet --features devnet → fails

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: onspeedhp

assertions/Cargo.toml

@@ -7,3 +7,9 @@ edition = "2021"
 pinocchio = { workspace = true }
 pinocchio-pubkey = { workspace = true }
 pinocchio-system = { workspace = true }
+
+# Cluster selection for the embedded program ID. Exactly one must be set
+# at build time; lib.rs emits a compile_error! otherwise.
+[features]
+mainnet = []
+devnet  = []

assertions/src/lib.rs

@@ -10,9 +10,32 @@ use pinocchio::{
 use pinocchio_pubkey::declare_id;
 use pinocchio_system::ID as SYSTEM_ID;
 
-// LazorKit Program ID
+// LazorKit Program ID — chosen at build time via the `mainnet` / `devnet`
+// cargo features. Exactly one must be enabled; otherwise the build fails
+// loudly via the `compile_error!` below. This prevents accidental cross-
+// cluster deploys (a binary compiled with one ID malfunctions if deployed
+// to a slot at the other ID — every internal `crate::ID` check fails).
+//
+// The mainnet ID intentionally matches lazorkit-protocol's mainnet ID:
+// program-v2 (no-fee foundation variant) is deployed to that slot for the
+// duration of the foundation contract; at contract end, the upgrade
+// authority swaps the binary at the same slot to lazorkit-protocol's
+// commercial build. dApp integrators keep using the same program ID
+// throughout — only the on-chain behavior changes.
+#[cfg(all(feature = "mainnet", not(feature = "devnet")))]
+declare_id!("LazorjRFNavitUaBu5m3WaNPjU1maipvSW2rZfAFAKi");
+
+#[cfg(all(feature = "devnet", not(feature = "mainnet")))]
 declare_id!("FLb7fyAtkfA4TSa2uYcAT8QKHd2pkoMHgmqfnXFXo7ao");
 
+#[cfg(any(
+    all(feature = "mainnet", feature = "devnet"),
+    all(not(feature = "mainnet"), not(feature = "devnet"))
+))]
+compile_error!(
+    "LazorKit: pick exactly one cluster — `--features mainnet` OR `--features devnet`"
+);
+
 #[allow(unused_imports)]
 use std::mem::MaybeUninit;
 

program/Cargo.toml

@@ -6,6 +6,14 @@ edition = "2021"
 [lib]
 crate-type = ["cdylib", "lib"]
 
+# Cluster selection — forwards to the assertions crate where the program ID
+# is embedded via declare_id!. Exactly one must be set at build time:
+#   cargo build-sbf --features mainnet
+#   cargo build-sbf --features devnet
+[features]
+mainnet = ["assertions/mainnet"]
+devnet  = ["assertions/devnet"]
+
 [dependencies]
 pinocchio = { workspace = true }
 pinocchio-pubkey = { workspace = true }