chore(contracts): testnet deploy scripts and demo-agent seeding

[moises-cisneros]

Closes #15

Summary

• scripts/deploy-testnet.sh: build + deploy del Identity Registry a testnet, escribe contracts/deployments/testnet.json e imprime la URL del explorer.
• scripts/seed-demo-agents.sh: registra 7 demo agents desde demo-agents.json, idempotente vía agent_id_by_uri (skipea con mensaje, reporta total_agents).
• Sección "Deploy" en contracts/README.md + .env.example raíz (solo identidad/red, cero seeds).

Acceptance criteria

• Running the deploy script from a clean clone deploys the contracts and updates testnet.json (pendiente: requiere identidad testnet fondeada)
• Every contract ID in testnet.json opens on a testnet explorer (pendiente del deploy en vivo)
• After seeding, reading the registry returns all the demo agents (pendiente del seed en vivo)
• Keys come from a Stellar CLI identity or from env vars. No secret seeds in the repo. .env.example is provided.
• Running the seed script twice does not create duplicates (por diseño: pre-check agent_id_by_uri + skip; pendiente de probar en vivo)

Verification evidence

bash -n scripts/deploy-testnet.sh && bash -n scripts/seed-demo-agents.sh  # SYNTAX-OK
git grep -nE "S[A-Z2-7]{55}" -- . ':!*.lock'                               # vacío, limpio
cargo test -p identity-registry                                            # 15 passed, 0 failed
# Fail-fast probado sin red: sin identidad -> "error: deploy/seed identity is missing..." exit 1
# Deploy/seed reales NO corridos (requieren identidad fondeada + red)

[cloudflare-workers-and-pages]

Deploying puls3 with    Cloudflare Pages

Latest commit:	9d65e75
Status:	✅  Deploy successful!
Preview URL:	https://7358a83d.puls3-4lw.pages.dev
Branch Preview URL:	https://chore-deploy-testnet.puls3-4lw.pages.dev

View logs

[XxHugheadxX]

@moises-cisneros ran the deploy and the seed live on testnet, as asked. The deploy script worked first time; the seed script had four bugs that kept it from registering any agent. Fixed and pushed on top of your branch (no force-push), then re-ran everything from a clean state.

Commits added

• 5433215 Merge main into this branch. The branch was 7 commits behind: deploying from it would have shipped the Identity Registry without the set_agent_uri TTL fix from feat(contracts): add agent identity registry per ADR-0002 #56.
• 3b98ce9 fix(scripts): make seed-demo-agents.sh run end to end
  1. invoke() already adds --, and every call added another (invoke -- total_agents), so the CLI failed with unexpected argument 'total_agents'. This broke the seed on any OS.
  2. Metadata values were plain text, but MetadataEntry.value is Bytes, which the CLI reads as hex: Failed to parse argument 'metadata'. Values are now hex-encoded at seed time, so demo-agents.json stays human-readable.
  3. On Windows, Python prints CRLF, so every URI carried a trailing \r: the metadata lookup failed, and a registered URI would have had an invisible character on-chain.
  4. On Windows, python3 can be a Microsoft Store alias that passes command -v but does not run. The script now checks the interpreter actually runs, and falls back to python.
     Also: on success it prints only the agent id; CLI logs are kept for error messages.
• 356507a Recorded the real deployment in contracts/deployments/testnet.json.
• 4cb7b7d Added the root .env.example that contracts/README.md refers to. It was missing because .gitignore ignored every .env.example until docs: decide USDC-over-SAC payment rail and testnet agent-wallet custody (ADR-0003) with a verified testnet payment PoC #59.
• 9d65e75 Removed openspec/: tooling config unrelated to chore: deploy contracts to testnet and seed demo agents #15.

Evidence (all run live on testnet)

Deploy:

Deploying identity-registry to testnet as puls3-deployer (GBY33NK3HMKQUKHL7YSCJ2W5JMJ62MEVKEJTRUWNQXBQIFLUVZY6TJ4R)...
✅ Deployed!
Explorer: https://stellar.expert/explorer/testnet/contract/CD5QZOKGRBV35C5SDT6PG7S72XGG4BHQAC2L56YLNBJDUL4LDMTXFIJJ

Seed, first run:

total_agents before: 0
registered: 'puls3://demo/payments-agent' -> agent 0
registered: 'puls3://demo/oracle-agent' -> agent 1
registered: 'puls3://demo/escrow-agent' -> agent 2
registered: 'puls3://demo/market-maker' -> agent 3
registered: 'puls3://demo/identity-verifier' -> agent 4
registered: 'puls3://demo/notifications-agent' -> agent 5
registered: 'puls3://demo/analytics-agent' -> agent 6
total_agents after: 7

Seed, second run (no duplicates):

total_agents before: 7
skip: 'puls3://demo/payments-agent' already registered as agent 0
...
skip: 'puls3://demo/analytics-agent' already registered as agent 6
total_agents after: 7

Reading the registry back with stellar contract invoke:

total_agents: 7
agent 0: "puls3://demo/payments-agent" | name=Payments Agent
agent 1: "puls3://demo/oracle-agent" | name=Oracle Agent
agent 2: "puls3://demo/escrow-agent" | name=Escrow Agent
agent 3: "puls3://demo/market-maker" | name=Market Maker
agent 4: "puls3://demo/identity-verifier" | name=Identity Verifier
agent 5: "puls3://demo/notifications-agent" | name=Notifications Agent
agent 6: "puls3://demo/analytics-agent" | name=Analytics Agent
owner_of 0: "GBY33NK3HMKQUKHL7YSCJ2W5JMJ62MEVKEJTRUWNQXBQIFLUVZY6TJ4R"

Secret scan on the added commits (S[A-Z2-7]{55}): no matches.

Acceptance criteria of #15, now

• Running the deploy script from a clean state deploys the contract and updates testnet.json
• Every contract ID in testnet.json opens on a testnet explorer (link above)
• After seeding, reading the registry returns all the demo agents (output above)
• Keys come from a Stellar CLI identity; no secret seeds in the repo; .env.example is provided
• Running the seed script twice does not create duplicates (second run above)

The PR body still says "Deploy/seed reales NO corridos"; you may want to update it to Closes #15 with this evidence.

Follow-ups (not blocking this PR)

• demo-agents.json lists different agents from the app's catalog (puls3_flutter/assets/mock/demo_agents.json: Ledger Scout, Copy Forge, ...). chore: deploy contracts to testnet and seed demo agents #15 says the seeded agents should be the same ones the catalog shows, and ADR-0004 expects prompt-only agents with HTTPS registration-file URIs rather than puls3://. Worth aligning before feat: Flutter catalog and register flow integration with Soroban Testnet #54 reads them.
• The contract admin and the demo agents' owner is a testnet identity (puls3-deployer) on the machine that ran this. Move it to whoever operates testnet (chore: testnet configuration and secrets management #30) if needed.