feat(CHAIN-4707): add Zeronet SystemConfig ownership transfer task

[0xth4nh]

What changed?

Adds the Zeronet task that transfers SystemConfig ownership from the proxy admin owner Safe to the incident multisig, on top of the shared active/evm project:

• active/evm/Makefile: task Makefile selecting this task/network, deriving per-Safe senders, wiring script/common/ownership/TransferSystemConfigOwnership.s.sol.
• config/zeronet/: .env (base-contracts v8.2.1), network.env, README.md, FACILITATOR guide.
• config/zeronet/validations/: generated coinbase-signer.json + security-council-signer.json (with skipTaskOriginValidation: true for Zeronet).

4th and final PR in the stack: #773 (foundation) → #775 (CI) → #776 (docs) → this.

Owners

Role	Address
Current owner (proxy admin owner)	0x3d59999977e0896ee1f8783bB8251DF16fb483E9
New owner (incident multisig)	0x856611ed7e07d83243b15e93f6321f2df6865852

How to test?

cd active/evm
make deps
make gen-validation-cb   # regenerates coinbase-signer.json (requires ottr-cli SSO)
make gen-validation-sc

The generated domain/message hashes match the committed validation files. forge build compiles the task against base-contracts v8.2.1. Post-check asserts SystemConfig.owner() == incident multisig.

[linear]

CHAIN-4707

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 2 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 2 2 1 if commit is unverified 0 Sum 2