[Feat]: Configure the final contract owner at deploy time

Component

Other

Priority

P2

Summary

The mainnet deployment should be run by an external party, so who deploys and who holds each role is decided by whoever runs it. The contracts already allow any choice they make: all ten UUPS proxies are upgradeable, every owner is transferable, roles are grantable and revocable, and the protocol registry can re-point any address. Nothing here blocks governance from upgrading or reconfiguring anything.

What the pipeline does not do is let them arrive at that model in one run. owner = msg.sender is hardcoded in DeployCore, DeployPolicy and WireDeployments, nothing ever calls transferOwnership, and WireDeployments._verifyDeployment asserts that every contract's owner is the deployer. So a deployment ends with the deploying key owning ten proxies, the protocol registry and the store factory, and moving that to governance means roughly a dozen manual transfers with nothing checking that none were missed.

The wire stage calls registry.set and grants roles, both onlyOwner, so the deployer has to own everything during deployment. The intended owner can only be assigned at the end.

Proposal

• Add DOTNS_OWNER, read the way WHITELIST_OPERATOR already is in WireDeployments, defaulting to the deploying account so current behaviour is unchanged.
• Add a final stage that assigns ownership of every proxy, the protocol registry and the store factory to DOTNS_OWNER, after wiring. A no-op when the value is the deployer.
• Have _verifyDeployment assert against the configured owner rather than msg.sender
• Decide single-step versus two-step ownership. OwnableUpgradeable transfers in one call, so a mistyped DOTNS_OWNER permanently destroys upgrade authority on a contract that can then no longer be upgraded to fix it. Ownable2StepUpgradeable makes the new owner accept, which may or may not be worth having when the target is a governance account, at the cost of an accept transaction.

Acceptance criteria

• DOTNS_OWNER sets the final owner and defaults to the deploying account.
• A final stage assigns ownership of every proxy, the registry and the store factory, and a re-run changes nothing.
• _verifyDeployment checks the configured owner
• A recorded decision on single- versus two-step ownership, implemented if two-step.

Start by tracing DeployCore, DeployPolicy, and WireDeployments, including how WireDeployments reads WHITELIST_OPERATOR and how _verifyDeployment validates owners. Decide and record whether ownership uses single-step or two-step transfer, then add the final ownership stage and verify that reruns are no-ops and the configured owner is checked.