chore(settlement): add +$90M headroom configs and production mint env sync

Support configurable Fineract headroom adjustment JSON paths and a helper to
emit mint/RPC/bitcoind keys for secure.omdnl.org deploy without printing secrets.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/post-btc-m2-headroom-adjustment.mjs

@@ -11,7 +11,10 @@ import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '../..');
-const configPath = path.join(repoRoot, 'config/offices/btc-m2-headroom-adjustment-20260720.v1.json');
+const configPath =
+  process.argv.find((a) => a.endsWith('.json')) ||
+  process.env.BTC_M2_HEADROOM_CONFIG ||
+  path.join(repoRoot, 'config/offices/btc-m2-headroom-adjustment-20260720.v1.json');
 
 const dryRun = process.argv.includes('--dry-run');
 const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));

scripts/deployment/sync-production-mint-env.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+/**
+ * Merge mint/RPC/bitcoind keys from repo .env into production env fragment (no stdout secrets).
+ *
+ *   node scripts/deployment/sync-production-mint-env.mjs --write .env.production-mint.fragment
+ */
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '../..');
+const envFile = process.env.OMNL_BANK_ENV || path.join(repoRoot, '.env');
+
+function parseEnv(file) {
+  const out = {};
+  if (!fs.existsSync(file)) return out;
+  for (const line of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
+    if (!line || line.startsWith('#') || !line.includes('=')) continue;
+    const i = line.indexOf('=');
+    out[line.slice(0, i).trim()] = line.slice(i + 1);
+  }
+  return out;
+}
+
+const env = parseEnv(envFile);
+const keys = [
+  'OMNL_MINT_OPERATOR_PRIVATE_KEY',
+  'RPC_URL_138',
+  'CHAIN_138_RPC_URL',
+  'SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE',
+  'OMNL_ALLOW_CHAIN_MINT_EXECUTE',
+  'BITCOIND_RPC_URL',
+  'BITCOIND_RPC_USER',
+  'BITCOIND_RPC_PASS',
+  'BTC_NETWORK',
+  'BTC_CONFIRMATIONS_REQUIRED',
+  'OMNL_BTC_WALLET_CONFIG',
+  'OMNL_BTC_LEDGER_CONFIG',
+  'CBTC_ADDRESS_138',
+  'DODO_PMM_INTEGRATION',
+  'CHAIN138_ORACLE_URL',
+];
+
+const lines = keys
+  .filter((k) => env[k]?.trim())
+  .map((k) => `${k}=${env[k].trim()}`);
+
+const writeArg = process.argv.indexOf('--write');
+if (writeArg >= 0) {
+  const out = process.argv[writeArg + 1] || path.join(repoRoot, '.env.production-mint.fragment');
+  fs.writeFileSync(out, `${lines.join('\n')}\n`, 'utf8');
+  console.log(`Wrote ${lines.length} keys to ${out}`);
+} else {
+  console.log(lines.map((l) => `${l.split('=')[0]}=***`).join('\n'));
+}