fix: validate release keys and smoke-run the genesis build on PRs - #254

Description

v0.5.6-rc1's genesis step died on cast's bare Failed to decode private key — the first time anything ever consumed the DOTNS_ADMIN_KEY secret was on master, because PR CI ran only bash -n and the extractor's unit tests, never the script.

Two changes:

• One credential, validated. DOTNS_ADMIN_KEY is now the only accepted owner key — the mnemonic fallback is gone (two credentials make the build guess which account owns everything, and the parity check validates addresses, not owners). A preflight rejects a malformed key before anvil starts and reports its shape — length, word count, a mnemonic hint with the cast wallet private-key derivation command — never the value, since a GitHub secret cannot be read back. Surrounding whitespace is stripped: a pasted trailing newline is the classic break, verified end to end.
• genesis-build-smoke.yml runs the exact release command with the real secrets on every PR touching contracts, deploy or genesis scripts, manifests, or the publish workflows — same-repo PRs only, parity unstubbed, artifact shape asserted and uploaded.

The smoke run on this PR doubles as the probe for the broken secret: expect it red, read the shape from its log, re-paste the secret, re-run. Then re-dispatch the failed Publish Beta Package for v0.5.6-rc1.

Type

• Bug fix
• Feature
• Breaking change
• Documentation
• Chore
• Refactor
• Security

Scope

• Registration
• Resolver
• Store
• Proof of Personhood
• Deployment scripts
• Tests

Related Issues

Follow-up to #253.

Fixes

Checklist

Code

• Follows project style
• forge build passes
• forge test passes
• No new compiler warnings

Testing

• New tests added for changed behavior
• Fuzz tests added where applicable
• Invariant tests verified

Security

• No new selfdestruct or delegatecall
• Access control reviewed
• No storage layout conflicts (for upgradeable contracts)

Documentation

• NatSpec updated on changed interfaces
• README updated if needed

Breaking Changes

• No breaking changes
• Breaking changes documented below

How to test

DOTNS_ADMIN_KEY="twelve word mnemonic ..." FACTORY_DEPLOYER_KEY=0x... bash scripts/genesis/build-genesis.sh   # shape diagnostic
gh workflow run genesis-build-smoke.yml

Exercised locally: all four malformed shapes fail fast without leaking the value; a newline-suffixed key completes the full build (33 accounts).

Notes

No Solidity changed; the contract checkboxes are inherited state.