chore: add scripts to upgrade all core contracts

src/script/UpgradeAllContracts.s.sol

@@ -103,7 +103,7 @@ contract UpgradeAllContracts is Script {
      * @dev Loads proxy addresses, deploys new implementations, and upgrades all proxies
      * @return newImpls Struct containing all newly deployed implementation addresses
      */
-    function run() external returns (NewImplementations memory newImpls) {
+    function run() public virtual returns (NewImplementations memory newImpls) {
         address deployer = vm.envOr("DEPLOYER_ADDRESS", DEFAULT_DEPLOYER_ADDRESS);
 
         ProxyAddresses memory proxies = _loadProxyAddresses();

src/script/UpgradeAllContractsEthereum.s.sol

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity 0.8.28;
+
+import {UpgradeAllContracts} from "./UpgradeAllContracts.s.sol";
+
+/**
+ * @title UpgradeAllContractsEthereum
+ * @notice Upgrades all deployed Core UUPS proxies on Ethereum mainnet.
+ *
+ * @dev Canonical mainnet proxy addresses (CreateX deterministic deployment — same as Sepolia):
+ *   - OraclePriceFeed:   0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16
+ *   - EigenAdapter:      0xe6168092892E545701D92BEe10149178bE0EEDF4
+ *   - StakeManager:      0x5be5220F81e76e0CF6089fb7E7aE9eF48a8D64Be
+ *   - RewardsManager:    0x8ae0F0B94fe782D7F055B04d4699c3cc01632b46
+ *   - SlashingManager:   0x7Bc39bf135eF3c30E542C196719c91455ff489f0
+ *   - SSPRouter:         0xF39E592E93A7a925a57464e0120B555A25590486
+ *   SymbioticAdapter is NOT deployed on mainnet — leave SYMBIOTIC_ADAPTER_PROXY unset.
+ *
+ * @dev Admin model: multisig 0xd2d03377Fa96687e9C11380DA9956AcC5F307e2c holds
+ *      DEFAULT_ADMIN_ROLE directly on core proxies. There is NO TimelockController for core
+ *      on any network (confirmed on-chain: SlashingManager.hasRole(DEFAULT_ADMIN_ROLE, Timelock)
+ *      == false). All upgrades are direct multisig Safe TX Builder calls.
+ *
+ *      This is distinct from the Coverage contracts, where DEFAULT_ADMIN_ROLE on the coverage
+ *      UUPS proxies is held by a TimelockController.
+ *
+ * @dev Prerequisites:
+ *   forge clean && forge build
+ *
+ * @dev Usage (broadcast from multisig EOA or via Safe execute):
+ *   DEPLOYER_ADDRESS=0xd2d03377Fa96687e9C11380DA9956AcC5F307e2c \
+ *   ORACLE_PRICE_FEED_PROXY=0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16 \
+ *   EIGEN_ADAPTER_PROXY=0xe6168092892E545701D92BEe10149178bE0EEDF4 \
+ *   STAKE_MANAGER_PROXY=0x5be5220F81e76e0CF6089fb7E7aE9eF48a8D64Be \
+ *   REWARDS_MANAGER_PROXY=0x8ae0F0B94fe782D7F055B04d4699c3cc01632b46 \
+ *   SLASHING_MANAGER_PROXY=0x7Bc39bf135eF3c30E542C196719c91455ff489f0 \
+ *   SSP_ROUTER_PROXY=0xF39E592E93A7a925a57464e0120B555A25590486 \
+ *     forge script src/script/UpgradeAllContractsEthereum.s.sol:UpgradeAllContractsEthereum \
+ *     --rpc-url $ETHEREUM_RPC_URL --broadcast --keystore $KEYSTORE --sender $DEPLOYER_ADDRESS
+ *
+ *   Then verify:
+ *     forge script src/script/VerifyCoreEthereum.s.sol --rpc-url $ETHEREUM_RPC_URL
+ *
+ *   Note: Mainnet WETH feed (hasPriceFeed == true) is already registered. No post-upgrade
+ *   feed registration is required, unlike Sepolia.
+ */
+contract UpgradeAllContractsEthereum is UpgradeAllContracts {
+    function run() public override returns (NewImplementations memory) {
+        require(block.chainid == 1, "Must run on Ethereum mainnet");
+        return super.run();
+    }
+}

src/script/UpgradeAllContractsSepolia.s.sol

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: BUSL-1.1
+pragma solidity 0.8.28;
+
+import {UpgradeAllContracts} from "./UpgradeAllContracts.s.sol";
+
+/**
+ * @title UpgradeAllContractsSepolia
+ * @notice Upgrades all deployed Core UUPS proxies on Sepolia testnet.
+ *
+ * @dev Canonical Sepolia proxy addresses (CreateX deterministic deployment — same as mainnet):
+ *   - OraclePriceFeed:   0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16
+ *   - EigenAdapter:      0xe6168092892E545701D92BEe10149178bE0EEDF4
+ *   - StakeManager:      0x5be5220F81e76e0CF6089fb7E7aE9eF48a8D64Be
+ *   - RewardsManager:    0x8ae0F0B94fe782D7F055B04d4699c3cc01632b46
+ *   - SlashingManager:   0x7Bc39bf135eF3c30E542C196719c91455ff489f0
+ *   - SSPRouter:         0xF39E592E93A7a925a57464e0120B555A25590486
+ *   SymbioticAdapter is NOT deployed on Sepolia — leave SYMBIOTIC_ADAPTER_PROXY unset.
+ *
+ * @dev Admin model: multisig 0xd2d03377Fa96687e9C11380DA9956AcC5F307e2c holds
+ *      DEFAULT_ADMIN_ROLE directly. No TimelockController for core on any network.
+ *
+ * @dev Prerequisites:
+ *   forge clean && forge build
+ *
+ * @dev Usage:
+ *   DEPLOYER_ADDRESS=0xd2d03377Fa96687e9C11380DA9956AcC5F307e2c \
+ *   ORACLE_PRICE_FEED_PROXY=0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16 \
+ *   EIGEN_ADAPTER_PROXY=0xe6168092892E545701D92BEe10149178bE0EEDF4 \
+ *   STAKE_MANAGER_PROXY=0x5be5220F81e76e0CF6089fb7E7aE9eF48a8D64Be \
+ *   REWARDS_MANAGER_PROXY=0x8ae0F0B94fe782D7F055B04d4699c3cc01632b46 \
+ *   SLASHING_MANAGER_PROXY=0x7Bc39bf135eF3c30E542C196719c91455ff489f0 \
+ *   SSP_ROUTER_PROXY=0xF39E592E93A7a925a57464e0120B555A25590486 \
+ *     forge script src/script/UpgradeAllContractsSepolia.s.sol:UpgradeAllContractsSepolia \
+ *     --rpc-url $SEPOLIA_RPC_URL --broadcast --keystore $KEYSTORE --sender $DEPLOYER_ADDRESS
+ *
+ *   Then verify:
+ *     forge script src/script/VerifyCoreSepolia.s.sol --rpc-url $SEPOLIA_RPC_URL
+ *
+ *   Post-upgrade (Sepolia only): register WETH price feed if not already present:
+ *     WETH=0x7b79995e5f793A07Bc00c21412e50Ecae098E7f9
+ *     CHAINLINK_ETH_USD=0x694AA1769357215DE4FAC081bf1f309aDC325306
+ *     cast send 0x57F750E3B8e095A5b3AE96030F0cac5dFe2f8A16 \
+ *       "setTokenPriceFeed(address,address,uint256)" $WETH $CHAINLINK_ETH_USD 3600 \
+ *       --keystore $KEYSTORE --rpc-url $SEPOLIA_RPC_URL
+ */
+contract UpgradeAllContractsSepolia is UpgradeAllContracts {
+    function run() public override returns (NewImplementations memory) {
+        require(block.chainid == 11_155_111, "Must run on Sepolia");
+        return super.run();
+    }
+}