security(mainnet): transfer Ownable admin off the hot deploy key to a multisig / cold wallet

[akash-mondal]

Tracker: #154

Context

The mainnet C-Chain (43114) eERC deployment went live 2026-07-09, but every mainnet contract's Ownable admin is still the hot deploy key 0x09b67991141146e2A43651C72CF6786eeb579846 (see docs/MAINNET_GO_NO_GO.md → "Remaining post-deploy items" and README.md → "What remains"). A single compromised key currently controls the entire mainnet stack. The go/no-go names this the top-priority post-deploy item.

Scope

• Choose the custody target (Gnosis Safe / multisig or a cold single-owner) and its signer set + threshold.
• Enumerate every mainnet contract exposing ownership/admin authority: EncryptedERC converter (0x708d…Db0e), Registrar (0x902B…79F2), the five verifiers, BabyJubJub, PrivateGiftEscrow (0xb22c…7C94), BenzoCCTPRouter (0x83F2…4caE) — confirm which are Ownable and which owner-only functions matter (e.g. setAuditorPublicKey, router allow-list mgmt).
• Draft the transferOwnership runbook (order, per-contract tx, human-confirmed broadcast) plus a rollback/verification plan.
• Update contracts/deployments/avalanche.json (and the packages/config mirror) with the new admin once transferred.

Acceptance criteria

• A written custody decision + signer/threshold recorded.
• A step-by-step transferOwnership runbook covering every owner-bearing mainnet contract.
• Post-transfer verification plan: on-chain owner() reads equal the new custody address for all contracts; manifest updated.
• No private-key operation is performed as part of this planning issue.

Dependencies

• None blocking; this is the top post-deploy item and should land first.
• Coordinates with the auditor-key custody + rotation issue (setAuditorPublicKey is an owner-gated call).