fix(deploy): require explicit sender on all production chains

[rplusq]

BaseScript's production guard only covered mainnet + optimism, so a Base/Arbitrum (or any other non-testnet) broadcast could silently fall back to the public TEST_MNEMONIC key. Invert the guard to an allow-list of local/testnet chains; every other chain must pass ETH_FROM.

🤖 Generated with Claude Code

[claude]

Claude finished @rplusq's task in 1m 7s —— View job

---

Review

• Gather context
• Read changed file and diff
• Analyze guard logic correctness
• Post review findings

✅ No issues found

The allowlist inversion is correct. The original denylist covered only mainnet + optimism, leaving Base, Arbitrum, and any future production chain silently unguarded. The new approach fails safe by default — any chain not explicitly allowlisted requires ETH_FROM.

Chain IDs verified:

• 31337 Anvil ✓
• 1337 Hardhat/localhost ✓
• 11155111 Sepolia ✓
• 11155420 Optimism Sepolia ✓
• 84532 Base Sepolia ✓
• 421614 Arbitrum Sepolia ✓

Logic is sound: the revert fires before deriveBroadcasterFromMnemonic() is reachable on production chains, so TEST_MNEMONIC cannot be used as a fallback key.

[rplusq]

Reworked: instead of inverting to a testnet allow-list, this now just adds the missing production chains (arbitrum 42161, base 8453) to the existing explicit guard alongside mainnet/optimism. Same coverage for the chains we actually deploy to, smaller diff, matches existing style. Also supersedes the HIGH finding on #50.