Redeploy hardened SubscriptionManager (+ extensions) to Base Sepolia

[KryptosAI]

Context

The SubscriptionManager currently deployed to Base Sepolia predates the security hardening landed in 66147b5:

• Period-bound renewal salts (InvalidSalt) — the deployed version allows one payer signature to be replayed for every remaining period
• Per-subscription held-balance escrow accounting + sweepCancelledSubscription
• OZ ECDSA.recover

AgentReputation / CrossChainSettlement extension deployments should be refreshed alongside if addresses are published.

Steps

1. forge script script/DeployExtensions.s.sol --rpc-url base_sepolia --broadcast (deployer key + gas — maintainer action)
2. Verify on Basescan
3. Update README addresses + contracts/deployments/base-sepolia.json + service envs
4. Add addresses to the weekly sepolia-smoke.yml checks

Acceptance criteria

• New addresses verified + smoke-tested; README/docs consistent
• Old address documented as deprecated/vulnerable

Severity: the replay hole is live on testnet (no real funds, but demos and docs point at it).

[KryptosAI]

Deployed. Security-hardened SubscriptionManager is live on Base Sepolia.

Address:     0x3116436B73e9Bbe230e517460A780359ba90B033
Tx:          0x3e20a2141c59d37f1e4407d13fc94e233b936f56a5af54df425128ba9865d883
Deployer:    0x9bAF5bDbE827ea13e85630DA9daAdEf016dFc89B
Balance:     ~0.0000325 ETH remaining

Includes: period-bound renewal salts (InvalidSalt), per-subscription heldBalance escrow, OZ ECDSA. Readme/deployments/smoke-workflow updated. Unverified on Basescan (no ETHERSCAN_API_KEY configured — add one to contracts/.env and I'll run forge verify-contract).

Remaining on #8: AgentReputation and CrossChainSettlement still need redeployment after real EAS is integrated (#2). SubscriptionManager is the highest-priority piece (it's the one with the live replay hole).

[KryptosAI]

AgentReputation also deployed (partial #8 completion).

Reputation is now real EAS, not MockEAS: deployed 0x014d6681978A43E0ceCF7BF6474095f7Fa5905f3 against 0x4200...0021 with a registered schema.

Still remaining for full #8: CrossChainSettlement still runs on MockAxelarGateway. That's blocked on #1 (Axelar GMP).