Run every operational path on testnet

[luchobonatti]

User story / Problem statement

M3 exits when every runbook has been executed at least once by the people who would execute it in production. Deploying is not enough: the paths that matter are the ones nobody exercises until an incident, and those are exactly the ones that fail.

Expected outcome

Every operational path driven on testnet, by its intended operator, at least once.

Acceptance criteria

• deposit through the full lifecycle: request, fulfill, claim
• redemption through the full lifecycle, including the solvency guard reverting on an underfunded strike
• deploy_capital to an allowlisted custodian, and a rejection to a non-allowlisted one
• guardian pause: intake and settlement halt, a fulfilled claim still pays, the admin resumes
• cancellation on both sides, including a de-listed controller being refused on the redeem side
• a compliance remedy, whichever path Resolve the six open decisions #8 chose
• a ripcord drill: raise, confirm nothing consumes the value, clear
• the walk-down drill, if F1 kept the symmetric cap
• a key rotation: revoke a treasury key and replace it without migrating contracts

Technical notes

The revert cases are as important as the happy paths. An underfunded strike reverting visibly is the behaviour ADR-0011 promises, and it should be seen once on a real network.

The TTL keeper runs for the whole phase, so archival gets exercised by elapsed time rather than simulated.

Depends on #15 for the deployment and #16 for the treasury console.