Add Monad CCIP deploy scripts, relay hardening, and bridge contract updates.

Includes Monad↔Chain138 CCIP proof/deploy/verify tooling, relay service guards,
bridge integration tweaks, and frontend ENS/network config follow-ups.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/deploy-monad-ccip-stack.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Deploy CCIP WETH9/WETH10 bridge stack on Monad mainnet (chain 143).
+# Uses WMON as wrapped native and native MON for CCIP fees (feeToken=0) until LINK exists on-chain.
+#
+# Usage:
+#   cd smom-dbis-138
+#   DRY_RUN=1 ./scripts/deployment/deploy-monad-ccip-stack.sh
+#   ./scripts/deployment/deploy-monad-ccip-stack.sh --execute
+#   ./scripts/deployment/deploy-monad-ccip-stack.sh --execute --configure-138
+#
+# After deploy: record addresses in .env, run complete-config-monad-chain138.sh, verify on monadscan.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+EXECUTE=0
+CONFIGURE_138=0
+FORCE=0
+DRY_RUN="${DRY_RUN:-0}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --configure-138) CONFIGURE_138=1; shift ;;
+    --force) FORCE=1; shift ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
+if [[ "$RPC" =~ infura\.io/v3/?$ ]]; then
+  RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+fi
+CHAIN_ID=143
+WMON="${WMON_MAINNET:-0x754704bc059f8c67012fed69bc8a327a5aafb603}"
+
+export CCIP_MONAD_ROUTER="${CCIP_MONAD_ROUTER:-0x33566fE5976AAa420F3d5C64996641Fc3858CaDB}"
+export MONAD_SELECTOR="${MONAD_SELECTOR:-8481857512324358265}"
+export CCIP_MONAD_LINK_TOKEN="${CCIP_MONAD_LINK_TOKEN:-0x0000000000000000000000000000000000000000}"
+export WETH9_MONAD="${WETH9_MONAD:-$WMON}"
+export WETH10_MONAD="${WETH10_MONAD:-$WMON}"
+
+echo "=== Monad CCIP stack deploy (chain $CHAIN_ID) ==="
+echo "RPC: ${RPC%%\?*}"
+echo "WMON: $WMON"
+echo "CCIP router: $CCIP_MONAD_ROUTER"
+echo "MONAD selector: $MONAD_SELECTOR"
+echo "Fee token: ${CCIP_MONAD_LINK_TOKEN} (0 = native MON)"
+
+if [[ "$FORCE" != "1" && -n "${CCIPWETH9_BRIDGE_MONAD:-}" && -n "${CCIPWETH10_BRIDGE_MONAD:-}" ]]; then
+  echo "Skip: CCIPWETH9_BRIDGE_MONAD and CCIPWETH10_BRIDGE_MONAD already set. Use --force to redeploy."
+  exit 0
+fi
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  echo ""
+  echo "[DRY RUN] forge script script/DeployAll.s.sol:DeployAll \\"
+  echo "  --rpc-url \"$RPC\" --chain-id $CHAIN_ID --broadcast --legacy -vvv"
+  echo ""
+  echo "Unset DRY_RUN and pass --execute to broadcast (requires PRIVATE_KEY in .env)."
+  exit 0
+fi
+
+if [[ "$EXECUTE" != "1" ]]; then
+  echo ""
+  echo "Pass --execute to broadcast (requires PRIVATE_KEY in .env)."
+  exit 0
+fi
+
+if ! require_private_key_env; then
+  exit 1
+fi
+
+"$SCRIPT_DIR/preflight-monad-deploy.sh"
+
+GAS_OPTS="--legacy"
+BROADCAST="--broadcast"
+CMD=(forge script script/DeployAll.s.sol:DeployAll
+  --rpc-url "$RPC"
+  --chain-id "$CHAIN_ID"
+  --private-key "$PRIVATE_KEY"
+  $BROADCAST
+  $GAS_OPTS
+  -vvv)
+
+echo ""
+echo "Broadcasting DeployAll on Monad..."
+"${CMD[@]}"
+
+OUT_DIR="$PROJECT_ROOT/broadcast/DeployAll.s.sol/$CHAIN_ID"
+echo ""
+echo "=== Deploy complete ==="
+echo "Inspect broadcast logs: $OUT_DIR"
+echo "Add to smom-dbis-138/.env:"
+echo "  WETH9_MONAD=$WETH9_MONAD"
+echo "  WETH10_MONAD=$WETH10_MONAD"
+echo "  CCIPWETH9_BRIDGE_MONAD=<from script output>"
+echo "  CCIPWETH10_BRIDGE_MONAD=<from script output>"
+echo "Verify: cd smom-dbis-138 && ./scripts/deployment/verify-all-networks-explorers.sh (when Monad supported)"
+
+if [[ "$CONFIGURE_138" == "1" ]]; then
+  echo ""
+  echo "Configuring Chain 138 <-> Monad destinations..."
+  "$SCRIPT_DIR/complete-config-monad-chain138.sh" || true
+fi