feat: add guarded Base Sepolia encore

docs/PRESENTER_RUNBOOK.md

@@ -74,6 +74,49 @@ The expected result is the same proxy and a new implementation, version `2`, Ali
 
 End the local session with Ctrl-C in the attached terminal, then `make reset-local`. The optional public encore is outside this prepared V1 run: local success does not depend on Base Sepolia, a faucet, an explorer, a wallet, or any external RPC.
 
+## Optional Base Sepolia encore
+
+Run this only after the completed local demo and only when the presenter explicitly chooses the public encore. Create a named encrypted Foundry keystore before any Base deployment, upgrade, transfer, selection, or archive command:
+
+```bash
+cast wallet import uups-bank-base --interactive
+cast wallet address --account uups-bank-base
+```
+
+Copy the displayed public address to `BASE_SEPOLIA_SENDER`, set `BASE_SEPOLIA_ACCOUNT=uups-bank-base`, and verify the two refer to the same account. Choose a different nonzero public address for `BASE_SEPOLIA_RECIPIENT`. Fund only the displayed Base Sepolia sender address with Base Sepolia test ETH. Never paste the key or password into Codex, shell history, or `.env`; Foundry requests the encrypted-keystore password through its interactive prompt.
+
+Copy `.env.example` to `.env` and configure:
+
+```dotenv
+# Terminal RPC may be credentialed; never copied into browser artifacts.
+BASE_SEPOLIA_RPC_URL=
+# Browser RPC is intentionally public and visible to browser users.
+BASE_SEPOLIA_PUBLIC_RPC_URL=https://sepolia.base.org
+BASE_SEPOLIA_ACCOUNT=uups-bank-base
+BASE_SEPOLIA_SENDER=
+BASE_SEPOLIA_RECIPIENT=
+```
+
+The Base commands require HTTPS RPCs, reject browser URL credentials, validate the named account identifier and distinct nonzero actors, and bind both `--account` and `--sender`. They never accept a raw key or mnemonic. First run the offline gate and inspect the fake-value dry run:
+
+```bash
+make verify
+bash tools/test-base-config.sh
+make -n deploy-base-sepolia BASE_SEPOLIA_RPC_URL=https://terminal.invalid BASE_SEPOLIA_PUBLIC_RPC_URL=https://public.invalid BASE_SEPOLIA_ACCOUNT=demo BASE_SEPOLIA_SENDER=0x1111111111111111111111111111111111111111 BASE_SEPOLIA_RECIPIENT=0x2222222222222222222222222222222222222222
+```
+
+The dry run must contain `--account`, `--sender`, and `--slow`, and must not contain a raw-key option. The URLs above are deliberately fake; these checks require no keystore, faucet, or network. Then, only with explicit authorization and Base Sepolia test funds, execute:
+
+```bash
+make deploy-base-sepolia
+make upgrade-base-sepolia
+make transfer-base-sepolia
+```
+
+Deployment mints valueless mUSDC only to Presenter and deposits `1,000 mUSDC`; Recipient starts at `0`. The V2 transfer produces Presenter `750 mUSDC` and Recipient `250 mUSDC`, while reserves and liabilities stay `1,000 mUSDC`. Each command runs an invariant-only state check. The confirmed browser manifest contains only the intentionally public browser RPC plus `https://sepolia.basescan.org`; the terminal RPC is never serialized.
+
+Before an intentional Base redeployment, run `make archive-base-manifest`. It moves only `deployments/base-sepolia.json` to a validated timestamped sibling and leaves `active.json` and Anvil state untouched. A subsequent finalizer may create a new Base canonical manifest; the old active copy remains the browser fallback until `make select-base-sepolia` succeeds. Use `make select-anvil` to return the browser to the local manifest. If a faucet, RPC, or explorer fails, record the optional failure and stop—the completed local demo remains the successful outcome.
+
 ## Closing trust disclosure checklist
 
 Read these points while the matching console panel is visible: