chore(injective): mainnet deploy config

[danvaneijck]

Adds script/config/injective-mainnet.json, so SCRIPT_CONFIG=injective-mainnet resolves.
Closes the infinity-core third of G-6 in SECURITY_AUDIT_2026-09-08.md — the audit's
finding was that the AMM could not be deployed to mainnet from the repo at all, because
BaseScript resolves SCRIPT_CONFIG to a file that did not exist.

A3 of Batch A. No src/ change, no test change, no deployed bytecode change.

The two filled addresses are DERIVED, not chosen

key	value	how it is known today
create3Factory	0xa4753315…07Df5	CREATE(0x02E0d5Fd…, 0) — confirmed with cast compute-address
poolOwner, protocolFeeControllerOwner	0x8a3c2cDa…bE10	CREATE3 at salt CHOICE-V2/TimelockController/1.0.0

The factory is deployed by plain CREATE from a dedicated nonce-0 EOA, never through the
Arachnid CREATE2 deployer — its constructor does Ownable(msg.sender) and
isUserWhitelisted[msg.sender] = true, so going through the deployer would make that stub the
owner and sole whitelisted user and brick the factory permanently. CREATE(eoa, 0) depends on
nothing else, which is what makes the address knowable before anything is deployed.

The timelock follows because CREATE3 derives an address from the salt and the factory alone.
It was derived by executing the deployed testnet factory's own bytecode at the mainnet factory
address (cast call --override-code) — and the control that makes it trustworthy rather than
merely computed is that the same method reproduces testnet's live timelock 0xfE9811111C…
exactly.

🔴 Both hold only if the factory is deployed from 0x02E0d5Fd… at nonce 0. Every predicted
address was checked EMPTY on 1776 before this was written.

Why every deployed-address field is "0x"

Following ethereum-mainnet.json, and it is not cosmetic. getAddressFromConfig decodes an
unset value to address(0x20) and reverts "Address not set" — so a script run before its
dependency has landed stops instead of deploying something wired to address(0). The fields
are filled in as each phase lands.

Checked

• Valid JSON; key set identical to injective-testnet.json, so no script finds a key missing
  at deploy time
• Every filled key decodes through BaseScript — create3Factory, poolOwner and
  protocolFeeControllerOwner all resolve to the addresses above
• Reading vault reverts "Address not set", proving the placeholder convention works in the
  direction that matters
• Script 01 against SCRIPT_CONFIG=injective-mainnet, no broadcast: reads the config, resolves
  the factory, and fails only on the factory not existing yet on 1776 — which is correct
• check-fork-pins.sh green

⚠️ Note for the reviewer, pre-existing and not from this PR: injective is 5 commits ahead of
the pin contracts/deployments/*.json names (c53aef3a). Those commits are CI, docs, a licence
notice and one test fix — src/ is byte-identical between the two, so no deployed bytecode is
affected. The fork-pin invariant is all copies of a fork agree with each other, not every pin is
at its fork's HEAD, so nothing is red.

🤖 Generated with Claude Code