feat: bridges, PMM, flash workflow, token-aggregation, and deployment docs

- CCIP/trustless bridge contracts, GRU tokens, DEX/PMM tests, reserve vault.
- Token-aggregation service routes, planner, chain config, relay env templates.
- Config snapshots and multi-chain deployment markdown updates.
- gitignore services/btc-intake/dist/ (tsc output); do not track dist.

Run forge build && forge test before deploy (large solc graph).

Made-with: Cursor

scripts/deployment/check-env-required.sh

@@ -50,10 +50,28 @@ for k in PRIVATE_KEY RPC_URL RPC_URL_138; do
   check "$k" && echo "  OK   $k" || echo "  MISS $k"
 done
 
-# PRIVATE_KEY format: 64 hex chars (no value printed)
+# PRIVATE_KEY format: 64 hex chars (no value printed). Use last assignment (dotenv override). Full value after first '='.
 if check "PRIVATE_KEY"; then
-  len=$(awk -F= '/^PRIVATE_KEY=/ { v=$2; gsub(/^0x/,"",v); print length(v) }' "$ENV_FILE" 2>/dev/null || echo "0")
-  [ "$len" = "64" ] && echo "       PRIVATE_KEY format: 64-char hex" || echo "       PRIVATE_KEY format: WARN (length=$len, expected 64)"
+  v="$(awk '
+    /^PRIVATE_KEY=/ { v=$0; sub(/^PRIVATE_KEY=/, "", v); last=v }
+    /^export[ \t]+PRIVATE_KEY=/ { v=$0; sub(/^export[ \t]+PRIVATE_KEY=/, "", v); last=v }
+    END { print last }
+  ' "$ENV_FILE" 2>/dev/null || true)"
+  v="${v//$'\r'/}"
+  v="${v#\"}"
+  v="${v%\"}"
+  v="${v#\'}"
+  v="${v%\'}"
+  v="$(printf '%s' "$v" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+  v="${v#0x}"
+  len=${#v}
+  if printf '%s' "$v" | grep -q '\${'; then
+    echo "       PRIVATE_KEY format: SKIP (value references another var in file; length=$len — check resolved key after source)"
+  elif [ "$len" = "64" ] && printf '%s' "$v" | grep -qE '^[0-9a-fA-F]{64}$'; then
+    echo "       PRIVATE_KEY format: 64-char hex"
+  else
+    echo "       PRIVATE_KEY format: WARN (length=$len, expected 64 hex chars after optional 0x)"
+  fi
 fi
 echo ""