feat(settlement): production BTC L1 rails, hot cBTC liquidity, Dfns/Cobo smoke

Add BTC L1 settle/reconcile/ledger APIs, bitcoind intake, cBTC PMM hot-LP scripts, and custody credential smoke tests (secrets stay gitignored). Enables full-prod local green health and server pull-deploy for secure.omdnl.org /btc/*.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/btc-regtest-bootstrap.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import http from 'http';
+import fs from 'fs';
+import path from 'path';
+
+const RPC_USER = process.env.BITCOIND_RPC_USER || 'omnl';
+const RPC_PASS = process.env.BITCOIND_RPC_PASS || 'omnl-regtest-local';
+const RPC_PORT = Number(process.env.BITCOIND_RPC_PORT || 18443);
+
+function rpc(method, params = []) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ jsonrpc: '1.0', id: 'e2e', method, params });
+    const req = http.request(
+      {
+        hostname: '127.0.0.1',
+        port: RPC_PORT,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: 'Basic ' + Buffer.from(`${RPC_USER}:${RPC_PASS}`).toString('base64'),
+          'Content-Length': Buffer.byteLength(body),
+        },
+      },
+      (res) => {
+        let d = '';
+        res.on('data', (c) => (d += c));
+        res.on('end', () => {
+          try {
+            const j = JSON.parse(d);
+            if (j.error) reject(new Error(JSON.stringify(j.error)));
+            else resolve(j.result);
+          } catch (e) {
+            reject(e);
+          }
+        });
+      },
+    );
+    req.on('error', reject);
+    req.write(body);
+    req.end();
+  });
+}
+
+function upsertEnv(file, key, value) {
+  if (!fs.existsSync(file)) return;
+  let txt = fs.readFileSync(file, 'utf8');
+  const line = `${key}=${value}`;
+  if (new RegExp(`^${key}=`, 'm').test(txt)) {
+    txt = txt.replace(new RegExp(`^${key}=.*$`, 'm'), line);
+  } else {
+    txt += `\n${line}\n`;
+  }
+  fs.writeFileSync(file, txt);
+}
+
+const info = await rpc('getblockchaininfo');
+console.log(`chain=${info.chain} blocks=${info.blocks}`);
+try {
+  await rpc('createwallet', ['omnl']);
+} catch {
+  /* exists */
+}
+try {
+  await rpc('loadwallet', ['omnl']);
+} catch {
+  /* loaded */
+}
+
+const addr = await rpc('getnewaddress', ['reserve', 'bech32']);
+if (info.blocks < 101) {
+  await rpc('generatetoaddress', [101 - info.blocks, addr]);
+}
+const bal = await rpc('getbalance');
+console.log(`REGTEST_READY addr=${addr} bal=${bal}`);
+
+const dep = await rpc('getnewaddress', ['omnl-e2e-deposit', 'bech32']);
+const txid = await rpc('sendtoaddress', [dep, 0.001]);
+await rpc('generatetoaddress', [6, addr]);
+const tx = await rpc('gettransaction', [txid]);
+console.log(`DEPOSIT txid=${txid} conf=${tx.confirmations} to=${dep}`);
+
+upsertEnv(path.resolve('.env'), 'BTC_RESERVE_ADDRESSES', addr);
+upsertEnv(path.resolve('config/deployment-omnl.production.env'), 'BTC_RESERVE_ADDRESSES', addr);
+
+console.log(
+  JSON.stringify({
+    reserve: addr,
+    deposit: dep,
+    txid,
+    confirmations: tx.confirmations,
+    amountSats: 100_000,
+  }),
+);