feat: add fork-tested in-place upgrade scripts for the deployed proxies

[sphamjoli]

Description

Adds the in-place upgrade path for the deployed Paseo Asset Hub proxies. Each upgraded proxy gets an Upgrade<Name>.s.sol script that drives the swap through Upgrades.upgradeProxy (a beacon rotation for the stores) with a mandatory storage-layout diff against a committed <Name>Old.sol snapshot and no unsafe overrides, paired one-to-one with a test/fork/Upgrade<Name>.t.sol that forks Paseo through the ETH-RPC adapter, upgrades the live proxy, and re-runs that contract's P0 paths.

Covered proxies: DotnsRegistrar, DotnsRegistrarController, DotnsPopController, PopRules, DotnsNameWhitelist, and the LabelStore beacon.

The storage layout is corrected on the contracts whose in-place upgrade the fail-closed diff rejected:

• DotnsRegistrar, DotnsPopController: the newly added mapping consumes one reserved slot, so __gap holds 49.
• DotnsNameWhitelist, DotnsRegistrarController: the AccessControl ERC-7201 namespace is retained as an unused annotated struct so the layout stays truthful after DotnsRoleManager is dropped.
• DotnsRegistrarController: the removed whiteList slot is retained as a placeholder so protocolRegistry keeps its slot.

Also adds bun run test:fork (start the adapter, clean build, run test/fork/**) and gives the fork tests their own CI shard so their outcome shows as a row in the CI Summary.

Type

• Feature
• Bug fix

Scope

• Registration
• Store
• Proof of Personhood
• Deployment scripts
• Tests

Related Issues

Fixes

A storage-layout incompatibility that would brick an in-place upgrade of DotnsRegistrarController: removing whiteList shifted protocolRegistry up one slot, so the upgraded implementation would read it as address(0).

Checklist

Code

• Follows project style
• forge build passes
• forge test passes
• No new compiler warnings

Testing

• New tests added for changed behavior
• Fuzz tests added where applicable
• Invariant tests verified

Security

• No new selfdestruct or delegatecall
• Access control reviewed
• No storage layout conflicts (for upgradeable contracts)

Documentation

• NatSpec updated on changed interfaces
• README updated if needed

Breaking Changes

• No breaking changes

How to test

bun run test:fork

Notes

The Upgrade*.s.sol scripts, *Old.sol snapshots, and test/fork/** are PR-scoped and deleted before merge per CONTRIBUTING.md. The storage-layout fixes on the contracts are permanent.

[github-actions]

CI Summary

Check	Result
4naly3er Analysis	Found 38 issues: 5 medium, 8 low, 14 gas, 11 informational - View Report
Slither Analysis	Found 183 issues: 4 high, 40 medium, 80 low, 59 informational - View Report
Contract Tests (Unit + Fuzz)	All tests passed (628 total) - View Report
Contract Tests (Invariant)	All tests passed (59 total) - View Report
Upgrade Fork Tests	All tests passed (11 total) - View Report
Gas Report	9 contracts analyzed - View Report
Coverage	74.0% line coverage - View Report
Documentation	Passed - 80 pages generated - View Docs
Format & Lint	Passed - Code formatted correctly
File Validation	Passed - All tracked files valid
Deploy Contracts	Reproduces the committed manifest; resume verified
PR Title	PR Title Valid
Labels	Unknown
Secret Scan	Passed - No secrets detected

Per-section details omitted: combined body exceeded the 65000-char comment limit. Follow the View Report links above for each section's full output.