Add governed rewarder factory, V1 controller, and vested minting

[dangerousfood]

Summary

• keep DeepstateRewarder V1 unchanged and extend it through DeepstateRewarderV2
• add a governance-owned rewarder factory with a revocable operator
• add a governance-owned DeepstateV1Controller that owns DeepstateV1 and delegates only pool-hook configuration to the factory
• add DeepstateMinterController as the policy-enforcing DEEP minter and temporary DEEP token administrator
• share Solady OwnableRoles ownership and non-renounceability through an abstract DeepstateController base
• create a separate non-cancelable, non-transferable one-year Sablier Lockup v4 stream for the immutable recipient on every mint
• enforce a constructor-configured live-supply soft cap, intended to be 20 billion DEEP in production
• return DEEP token administration safely to the minter controller's current governance owner after the two-year administration term
• enforce one successful market deployment globally every three days
• prevent overwriting active or pre-existing hooks
• retire factory markets by detaching the hook and burning the rewarder's entire live DEEP balance in place

Authority model

• governance owns the V1 controller, rewarder factory, and minter controller; the factory owns every V2 rewarder it deploys
• both controllers inherit Solady OwnableRoles from DeepstateController; governance owns them and neither can renounce ownership
• the minter controller temporarily holds DeepstateToken.DEFAULT_ADMIN_ROLE
• the two-year token-administration clock starts only when governance explicitly locks it after granting the controller DEEP admin authority
• no account, including the controller owner, can unlock token administration before the exact deadline; afterward anyone can trigger the unlock
• handback grants DEEP admin to the controller's current owner before the controller renounces it, so there is no zero-admin transition
• tokenAdministrationEndsAt encodes the full lifecycle: zero before locking, the deadline while active, and type(uint40).max after permanent return; the terminal sentinel prevents another cycle without a second storage flag
• controller ownership transfers move owner authority without mutating delegated MINTER_ROLE bits, and ownership renunciation is disabled
• the controller owner can mint independently of MINTER_ROLE; ownership rotation moves that authority without changing delegated minter roles
• every non-owner mint requires DeepstateMinterController.MINTER_ROLE
• the V1 controller owns DeepstateV1
• the factory holds the V1 controller's independently revocable HOOK_MANAGER_ROLE
• factory and V1-controller ownership are intentionally independent; operational authority comes from the explicit role grant
• V2 rewarder balance burns use inherited Ownable.onlyOwner, accept no caller-supplied amount, return no value, and report the burned live balance through RewardBalanceBurned; there is no separate factory authorization path
• the factory holds DeepstateMinterController.MINTER_ROLE; it does not hold DeepstateToken.MINTER_ROLE
• the minter controller must be the sole operational holder of DeepstateToken.MINTER_ROLE
• the factory operator can only deploy and retire markets through the factory
• the operator and factory cannot configure protocol fees, transfer DeepstateV1 ownership, redirect the vesting recipient, bypass the 30% mint policy, or change the supply cap
• governance can configure hooks and fees, revoke the factory operator or HOOK_MANAGER_ROLE, retire markets, administer controller roles, and recover DeepstateV1 ownership

Fixed economics

• deployment cooldown: 3 days
• reward schedule duration: 395 days
• scheduled cap: 500 million DEEP per side / 1 billion total
• rewarder initial funding: 100 million DEEP per market
• recipient allocation: floor(requestedMint * 30 / 70), making the recipient 30% of combined issuance
• each factory launch therefore issues 100 million DEEP to the rewarder and floor(100 million * 30 / 70) DEEP into vesting
• recipient vesting: one independent 365-day linear stream per mint
• streams: non-cancelable and NFT non-transferable
• production mint-controller cap: 20 billion DEEP, passed immutably at deployment
• the cap checks live DeepstateToken.totalSupply() plus both new mint legs; burns reopen capacity
• retiring a market burns unspent rewarder funding but does not cancel its independent recipient stream
• the remaining 900 million reward budget is outside the factory and requires a governance-authorized controller mint, which also creates a floor(900 million * 30 / 70) recipient stream

Sablier integration

• pins Sablier Lockup v4.0.1, PRBMath v4.1.0, and Chainlink contracts v1.3.0 as git submodules
• accepts an existing compatible Sablier Lockup v4 contract as an immutable constructor argument
• each mint creates a stream NFT; it does not deploy another Sablier protocol instance
• the stock Sablier call atomically pulls the exact approved allocation, consuming the temporary allowance back to zero without a redundant approval call
• real-Sablier integration tests prove that the full new allocation enters the stream while pre-existing controller balances remain untouched; production avoids redundant runtime balance reads
• rejects dust mints, uint128 overflow, live-supply cap overflow, missing authority, Sablier failures, and reentrant Lockup callbacks

Activation sequence

1. select or deploy a compatible Sablier Lockup v4 contract
2. deploy DeepstateMinterController with Governor as its Solady owner, DEEP, Sablier Lockup, the final recipient, and the 20 billion DEEP cap; owner mint authority is independent of delegated MINTER_ROLE bits
3. deploy DeepstateV1Controller with Governor as owner
4. deploy DeepstateRewarderFactory with the same Governor owner, V1 controller, and minter controller
5. grant DeepstateToken.DEFAULT_ADMIN_ROLE to the minter controller
6. have Governor call lockTokenAdministration(), which starts the exact two-year clock and ensures the controller has DeepstateToken.MINTER_ROLE
7. remove every bypassing token-level minter and have the prior DEEP admin renounce its admin role, leaving the controller as token administrator
8. grant the factory DeepstateMinterController.MINTER_ROLE with grantRoles(factory, MINTER_ROLE)
9. transfer DeepstateV1 ownership to the V1 controller
10. grant the factory DeepstateV1Controller.HOOK_MANAGER_ROLE with grantRoles(factory, HOOK_MANAGER_ROLE)
11. set the team operational address with factory.setOperator(operator)
12. after two years, call unlockTokenAdministration() permissionlessly; no account can call it sooner

Verification

• 213 behavioral tests and 5 invariant tests pass from a clean checkout
• invariant tests execute 640,000 handler transitions without a revert or discard
• DeepstateController, DeepstateMinterController, and DeepstateV1Controller: 100% lines, statements, branches, and functions
• cap tests cover exact capacity, pre-existing supply, both mint legs, rejection above cap, and capacity reopened by burns
• fuzz tests prove each mint's recipient tranche equals floor(30% of combined issuance) across the bounded mint range
• administration tests cover locking, owner early-unlock rejection, exact-deadline public unlock, grant-first handback, missing authority, repeat calls, direct ownership transfer, two-step ownership handover, owner minting without MINTER_ROLE, delegated minter roles, and same-owner transfer safety
• integration tests run against the pinned real Sablier Lockup v4.0.1 implementation and verify midpoint/final vesting, withdrawals, cancellation rejection, and transfer rejection
• deployment shell checks, formatting, and production contract size checks pass
• minter controller runtime: 4,948 bytes
• factory runtime: 16,135 bytes
• V1 controller runtime: 2,088 bytes
• V2 runtime: 10,373 bytes