[real-value/contracts] Add pilot contracts proof command

[FlowmemoryAI]

Objective

Add the dedicated contracts proof command required by the final real-value pilot gate:

npm run flowchain:real-value-pilot:contracts

Acceptance Criteria

• Command exists at the repo root and can run from a clean checkout after normal dependency setup.
• Verifies Base chain ID 8453 deployment configuration without hardcoded blanket endorsement.
• Proves lockbox config, ignored/local env boundaries, per-deposit cap, total pilot cap, supported-asset allowlist, pause, release/recovery, and replay protections.
• Includes dry-run deployment/source-verification instructions and no committed secrets.
• Records exact commands, reports, blockers, allowed folders, and forbidden folders in the PR.
• npm run flowchain:product-e2e, npm run flowchain:l1-e2e, node infra/scripts/check-unsafe-claims.mjs, and git diff --check pass or failures are assigned with owner and next action.

Out Of Scope

• Public launch, tokenomics, production bridge custody, or broad bridge readiness claims.

[FlowmemoryAI]

HQ refresh after PR #132 merged to main:

• Local worktree inspected: E:\FlowMemory\flowmemory-live-contracts on agent/real-value-pilot-contracts.
• Branch checklist reports the contract proof complete: forge test, npm run contracts:hardening, Base 8453 deploy gating, caps/allowlist/pause/release/replay coverage, dry-run deployment, docs, and npm run flowchain:product-e2e.
• No PR currently exists for agent/real-value-pilot-contracts.
• Main still has no dedicated npm run flowchain:real-value-pilot:contracts, so the strict HQ gate still fails on this proof row.

Next integration action: rebase/freshen the contracts branch onto main commit 14f378b, add the root proof command, rerun the exact proof commands, open a PR, and include the deploy dry-run/source-verification evidence in the PR summary.

[FlowmemoryAI]

HQ recheck after PR #141 on the contracts branch:

• Worktree: E:\FlowMemory\flowmemory-live-contracts
• Branch: agent/real-value-pilot-contracts
• Current branch is not yet based on current main; it needs rebase/reconciliation with commit f384236.
• Branch-local contract proof exists through npm run contracts:hardening.
• Root package does not yet expose the required dedicated flowchain:real-value-pilot:contracts command expected by the merged HQ gate.

Fresh commands run from that worktree:

npm run contracts:hardening
node infra/scripts/check-unsafe-claims.mjs
git diff --check

Results:

• npm run contracts:hardening passed.
• Foundry passed 87 tests, including the lockbox and settlement-spine coverage.
• Slither analyzed 29 contracts with 100 detectors and found 0 results.
• node infra/scripts/check-unsafe-claims.mjs passed.
• git diff --check passed with Windows line-ending warnings only.

Next action: rebase this branch onto current main, add root flowchain:real-value-pilot:contracts delegating to the hardening/deploy-dry-run proof set, rerun product evidence, then open a PR linked to #133.