feat(sepolia): add Nitro validator cutover task

[leopoldjoy]

Summary

• replicate the hinted Nitro validator and TEE registry cutover from feat(zeronet): add Nitro validator cutover task #781 for Sepolia
• configure the live Sepolia registry, ProxyAdmin custody, CertManager owner/revoker, and rollback anchors
• preserve the forward, rollback, nonce-coordination, and canary registrar cutover flow
• leave deployment addresses, validation files, signatures, and execution records for the facilitator workflow

Sepolia Configuration

• TEE registry proxy: 0xf0d7E15673fBA052e83d7f2b26BB6071E86b972e
• current implementation: 0xF9Ab55c35cE7Fb183A50E611B63558499130D849
• legacy Nitro verifier: 0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72
• CertManager owner: 0x646132A1667ca7aD00d36616AFBA1A28116C770A
• CertManager revoker: 0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3

These values were checked against the repository network config and live Ethereum Sepolia state.

Verification

• make deps
• make validate-deploy-config
• mise exec -- forge fmt --check tasks/2026-08-20-upgrade-tee-registry-nitro-validator/script/
• built DeployNitroValidatorStack.s.sol with FOUNDRY_PROFILE=nitro-deploy
• built DeployTEEProverRegistryImpl.s.sol with FOUNDRY_PROFILE=tee-registry-deploy
• built SetTEEProverRegistryImpl.s.sol
• verified live proxy admin, implementation, registry version, owner, manager, legacy Nitro verifier, TEE verifier pointer, proposer/challenger validity, and current signer validity

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 2 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 2 2 1 if commit is unverified 0 Sum 2

[leopoldjoy]

Superseded: this rollout should be added as a Sepolia config on the existing multi-network task. I am replacing this PR with a change that reverts #782, restores the original task to active/evm/tasks, and scopes deployment addresses by network.