security(mainnet): harden the CCTP onramp beyond the single 0.1 USDC test burn

[akash-mondal]

Tracker: #154

Context

The mainnet CCTP onramp is proven by exactly one 0.1 USDC Base→Avalanche burn (settle tx 0xc479b7c8…f8a3); docs/MAINNET_GO_NO_GO.md lists "harden the CCTP onramp beyond the single test burn" as an open post-deploy item. The path spans BenzoCCTPRouter (0x83F2…4caE), the attestation poller, and the gas-sponsored settleDeposit relayer job (delivered in #108–#111).

Scope

• Load testing (concurrent burns/attestations), failure injection (dropped / late / duplicate attestation, RPC flaps), and adversarial cases (wrong token, unregistered recipient, fee shortfall — already Fuji-fork-tested; re-exercise on mainnet-shaped fixtures).
• Relayer resilience: nonce management under concurrency, gas-sponsorship funding floor + alerting, stuck-submitted reconciliation (cf. [backend] Treasury deposit reconciler: settle stuck 'submitted'-with-hash rows #136), and settleDeposit idempotency.
• Production SLOs/alerts for the onramp poller (the second backend container) and a rescue runbook (cf. scripts/e2e/cctp-rescue.ts).

Acceptance criteria

• A documented test matrix (load + failure-injection + adversarial) with results.
• Relayer funding floor + alerting + nonce/idempotency guarantees specified and, where testable, exercised on the Fuji-fork / testnet tiers.
• A written onramp incident/rescue runbook.

Dependencies

• Builds on [contracts] BenzoCCTPRouter: CCTP V2 mint recipient that deposits-on-behalf into eERC #108–[backend] CCTP relayer service: attestation poller + gas-sponsored settleDeposit job #111 (CCTP router, onramp intents, relayer) and the TIER-1 Fuji-fork tests ([test] Live-testnet e2e workspace + Fuji-fork PR tier + funded nightly suites & CI wiring #119). Planning this spends no mainnet funds.