verify: point Sourcify at Rome's own instance, and sweep a network's deployments

[anil-rome]

hardhat verify was submitting to sourcify.dev, which answers "Chain 200010 not found" — it has never heard of these chains. Setting verify.sourcify.apiUrl to Rome's own instance is the whole fix. Etherscan and Blockscout are switched off rather than left to fail on every run, since no Rome chain is listed on either.

Proven against live deployments

Five contracts that were unverified on Hadrian now verify with one command each:

BatchReader	✅
PythPullAdapterImpl	✅
SwitchboardV3AdapterImpl	✅
CachedPythAdapterImpl	✅
CachedFeedAdapter	✅ — needs --contract, a test harness in the tree shares its bytecode

Before: HHE80002 … sourcify.dev … "Chain 200010 not found". After: ✅ Contract verified successfully on Sourcify, and the verifier's read endpoint flips 404 → 200.

The sweep, and why it classifies instead of counting failures

scripts/verify-deployments.sh <network> walks every address in deployments/<network>.json, skips what is already verified, and names what it could not do:

of 50 addresses in the manifest:
  already verified 9 · newly verified 0 · need a human 1 · drifted 8 · not this project's 32

• not this project's (32) — no solc metadata or no bytecode: precompile handles and foreign contracts. The manifest is full of them, and counting them as gaps would make the summary useless.
• need a human (1) — a constructor takes arguments the manifest does not record.
• drifted (8) — bytecode matches nothing in current source. This is the bucket that matters: those addresses can never be verified now, because the source that produced them has moved on. It is the argument for verifying at deploy time, which the companion CI change does.

Advisory by design — exits 0, so it can run after a deploy without ever failing one.

Two things I got wrong while building it

• mapfile — macOS ships bash 3.2, which does not have it. A script that only runs on the CI runner is one nobody can check locally, so it uses a read loop.
• The already-verified pre-check had no retry, so a single timeout reclassified a verified contract as a gap and the counts moved between runs. It retries once; the summary is now stable across consecutive runs.

package-lock.json is deliberately untouched — installing on macOS strips libc entries that a Linux install adds, and shipping that would churn CI installs.

Companion: contract-deploys wires this into the five deploy workflows.