feat(gateway): V2 scale-hardening — nonce-manager + RPC failover + batch attest (#126 P2)

[LamaSu]

V2 scale-hardening for the settlement path (board #126 P2-SCALE — concurrent-create race #154 flagged as separate P2; single-settle already works live). Additive, flag-gated, V1/V2 intact.

ADDS: (1) Nonce manager (nonce-manager.ts) — per-signer serialized queue, monotonic nonces, self-healing re-seed; process-wide registry keyed by signer so all 14 V1+V2 escrow-client writes + paid-job-flow create share ONE queue. Consolidates #145 inline logic. Kill-switch PCC_NONCE_MANAGER_DISABLED. (2) RPC failover+retry (rpc-transport.ts) — viem fallback() primary+fallback, retry/backoff/timeout; getRpcUrls() (PCC_RPC_URLS); oracle verifyWithOracle -> fetchWithRetry. (3) Batch attest (eas-client.ts) — EAS multiAttest + submitMilestoneAttestationsBatch, flag PCC_EAS_MULTIATTEST, no-op <2.

Tests +60. On Spark: gateway 1661 pass/4 skip, contracts 250 pass, build 52/52, typecheck 0.

⚠️ Needs rebase before merge: off 799eff6 (pre-#152); conflicts with merged #152 in escrow-client.ts + oracle-client.ts (both touch them). Other 13 files clean — resolve preserving BOTH.

[LamaSu]

Agreed on all four — the failover path is the right thing to be careful about, since it sits directly on paid writes. Confirming each against the current rpc-transport.ts / nonce-manager.ts:

1. Writes must not double-send; already known / nonce too low are idempotent results, not failures.
viem's fallback re-sends the same serialized tx on eth_sendRawTransaction failover, so a rotated retry is the identical hash (the network dedupes → already known), not a second spend — good. The gap is in handling: NonceManager.run rethrows on any isNonceError, so a benign already known (the tx already reached the mempool via the primary) surfaces to the caller as a settlement failure — which then either retries with a fresh nonce (the real double-send) or marks the milestone failed (the "silently vanishes" case). Fix:

• already known → success: resolve with the tx hash (compute it from the signed tx before broadcast, or read it back), advance the cursor, don't rethrow.
• nonce too low → ambiguous: look up our pre-computed tx hash on-chain first — if it's mined/pending it's idempotent success; only if a different tx took the nonce is it a real failure (then re-seed + surface). Never assume success without confirming the hash.
• Only ever re-broadcast the byte-identical signed tx; never re-sign / rebuild on the retry path.

2. chainId gate before a URL enters fallback().
buildRpcTransport wraps each URL in http() with no chain check, so a misconfigured PCC_RPC_URLS entry (or a URL silently serving another chain) can enter the rotation. Add a one-time eth_chainId assertion per URL against the expected getChainId(network) and drop / hard-fail mismatches before they're eligible for a write. (EIP-155 signed txs carry chainId, so a wrong-chain node rejects at broadcast — but catching it at transport-build time beats catching it mid-settlement.)

3. verifyWithOracle → fetchWithRetry must reject stale block data, not only transport errors.
Retry currently triggers on transport/timeout only; a healthy-but-lagging endpoint returning an old block passes. Add a freshness gate: capture the block number, require it monotonic vs last-seen and within N blocks of the max seen across endpoints, and treat a stale read as a retriable failure (rotate), not a valid response. Otherwise verification can pass against outdated escrow state.

4. PCC_NONCE_MANAGER_DISABLED must not let the retry path mask a nonce race.
With the manager bypassed we're on viem auto-nonce + per-endpoint retry. Nonce errors are deterministic, not transient — ensure the disabled path surfaces an isNonceError loudly instead of retrying/failing-over as if transient, so the kill-switch can't hide a real race.

Tests — your shape plus a few:

// reads fail over; a paid write is retried only with the same signed tx
// RPC-A: eth_call times out, then returns a stale block number
// RPC-B: healthy, expected chainId, current block
// expect: reads rotate to B; sendRawTransaction re-sends identical bytes;
//         `already known` from B resolves to the original tx hash (no throw)

• chainId-mismatch URL is rejected at buildRpcTransport (never eligible for a write)
• stale-block oracle read rotates instead of being accepted
• with PCC_NONCE_MANAGER_DISABLED, a nonce error surfaces (is not retried/masked)

I can implement these on a follow-up branch off this one and run the suite on Spark (this checkout is mid-work on another branch, so I'm keeping clear of it directly). Want me to take that?