Multi-sig upgrade authority policy for mainnet PROGRAM_ID

[kh0ra]

Goal

Define who holds the upgrade authority for the mainnet mosaic_program.so, with multi-sig + hardware-wallet protections.

Open questions

• Multi-sig threshold (2-of-3 across founders? 3-of-5 with audit firm + community member?)
• Squads vs Realms vs simple Solana multi-sig
• Hardware wallet vendor (Ledger Nano S+ or Yubikey-backed signing)
• Emergency freeze authority — same multi-sig or separate?
• Sunset: when do we burn the upgrade authority and make the program immutable?

Sub-tasks

• Decision document in docs/upgrade-authority.md
• Multi-sig setup on devnet first (Devnet: deploy mosaic_program.so + 24 h soak harness #67) — test the actual signing flow
• Document key-loss recovery procedure
• Review with audit firm

Blocks

Mainnet deployment (#68, #66).