chore(deploy): config-driven price-oracle bring-up script + runbook + config block

[drewstone]

Summary

Closes the ops/deploy gap behind the oracle audit fixes. The price oracle is real and consumed (Tangle payments/exposure + ServiceFeeDistributor), but FullDeploy only wires a pre-existing address — it never deploys or configures one, and base-mainnet.json left it unset. So the protocol launches on the raw-token-amount fallback (intentional at genesis: the exposure-weighted rail is dormant, incentives.weights.stakersBps = 0) with no scripted/runbooked path to turn USD normalization on. This adds that path. No src/ changes.

What's here

• script/ConfigureOracle.s.sol — config-driven (reads the oracle block of FULL_DEPLOY_CONFIG, same convention as FullDeploy/DeployGovernance):
  • deploys a ChainlinkOracle or UniswapV3Oracle,
  • configures every feed (chainlink) / pool (uniswap) + maxAge + the L2 sequencer-uptime gate,
  • optionally wires Tangle + ServiceFeeDistributor via setPriceOracle (bootstrap window only — needs ADMIN_ROLE),
  • hands the oracle's Ownable ownership to the timelock/multisig as the final step,
  • production guard (bypass TANGLE_DEPLOY_LOCAL=1): requires owner set, maxAge set, ≥1 feed/pool, and the sequencer feed on Base/OP/Arbitrum,
  • writes a manifest; prints the governance setPriceOracle calls when wire=false.
• deploy/RUNBOOK-launch.md §3c — oracle bring-up procedure: bootstrap-vs-governance wiring, required prod params, and the stakersBps flip to actually activate the rail.
• deploy/config/base-mainnet.json — self-documenting oracle block: deploy=false at genesis, Base sequencer feed pre-filled, TODOs for feeds/owner.

Verification

• Script compiles; dry-run ran end-to-end in-EVM (parse config → deploy oracle → set sequencer/maxAge → write manifest → print governance wiring).
• base-mainnet.json validated as JSON.
• Independent of the oracle-fix PR (fix(oracles): UniswapV3Oracle quote-feed circuit breaker + setTwapPeriod cardinality recheck #187) — uses only unchanged public oracle APIs, branches off main, clean merge.

Usage:

PRIVATE_KEY=<pk> FULL_DEPLOY_CONFIG=deploy/config/base-mainnet.json \
  forge script script/ConfigureOracle.s.sol:ConfigureOracle --rpc-url "$L2_RPC" --broadcast --slow

[tangletools]

✅ Auto-approved PR — a833a702

Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-20T05:15:23Z}