ceremony: run an open multi-party Groth16 phase-2 ceremony with independent external participants

[akash-mondal]

Tracker: #154

Context

The verifiers backing mainnet come from a single-coordinator, 3-machine Groth16 phase-2 ceremony (drand quicknet round 30261477) — see docs/ceremony/transcript.md and the build: "ceremony" marker in contracts/scripts/ceremony/ceremony-marker.json. Both the transcript and README state plainly this is not a substitute for an open multi-party ceremony with independent external participants; its soundness rests on the honest-machine assumption plus the unbiasable beacon. Closing that gap is the honest next step for a mainnet holding real value. (The completed single-coordinator run is #121; this issue supersedes its trust model, it does not reopen it.)

Scope

• Design an open ceremony: participant recruitment/onboarding, contribution coordinator, attestation collection, and a final public beacon.
• Reuse scripts/ceremony/run-ceremony.ts; extend it for external contributions + a public contribution feed.
• Regenerate the five verifiers + browser proving keys (packages/config/public/circuits/*) from the new final zkeys; keep on-chain verifier and in-browser .zkey byte-identical (same sha256), as today.
• Republish docs/ceremony/transcript.md, bump ceremony-marker.json, and plan the verifier redeploy/upgrade path — note the deploy:mainnet guardrail asserts the ceremony marker (guardrail Build wallet export, import, and local account deletion #4 / ceremony_build_required).

Acceptance criteria

• A ceremony plan (participants, tooling, beacon, verification instructions) reviewed and agreed.
• A Fuji/testnet dry-run regenerating verifiers end-to-end with the new tooling.
• A defined path to swap mainnet verifiers to the open-ceremony build (redeploy vs upgrade) with the guardrail marker updated.

Dependencies

• Verifier swap coordinates with the Ownable admin-custody transfer and the external-audit timing.