Mainnet deployment of stream-core v4

[gbengaeben]

Category: Security | Priority: High | Dependencies: #10 (load test informs keeper tuning), audit is a separate issue | Out of scope: third-party audit (own issue), Grafana dashboards (own issue)

Description & Context: Contract, keeper, and indexer are Testnet-proven. Mainnet is the wave-submission differentiator; this tracks the deployment itself.

Acceptance Criteria / DoD:

• stream_core.wasm built from main and deployed with a funded admin; contract id recorded
• version() returns 4 on Mainnet; native SAC + one custom token stream created as a smoke test
• Keeper runs against Mainnet (KEEPER_SECRET from a dedicated funded account, never the admin key); instance + stream TTLs observed re-arming on real ledgers over ≥1 keeper pass
• README.md Networks section updated with the live Mainnet contract id and RPC_URL/VITE_* values
• Rollback/emergency notes: admin pause tested on Mainnet (create blocked, withdraw unaffected)

How to verify: Public Mainnet contract id + tx hashes for deploy and one keeper bump; GET /status on the production keeper shows ok:true.