feat: Add ai generated example for Arbitrum deployment

[lucas-manuel]

What is on the branch

Two scripts, a shared library, inputs, tests and Makefile targets in spark-pau-deploy on add-ai-example-arbitrum. Nothing is committed yet.

src/ParallelPAULib.sol holds both production steps. deploy creates Beacon, CCTPFacet (wired as CCTP_FACET), PAUFactory, AdministeredAgentFactory, then AccessControls, RateLimits, Controller against the existing ALMProxy, and one AdministeredAgent, all with the deployer as admin. configure adds agent actors, grantor and revoker, grants ALLOCATOR_ROLE to the agent and CONTROLLER on the new RateLimits to the controller, syncs CCTP_FACET, sets the Ethereum domain parameters, then hands every admin role to the Spark Executor and revokes the deployer. checkConfigured reverts on any deviation, so a bad input aborts in simulation.
src/CCTPFacetWiring.sol is the canonical ten-wire selector set.
script/parallel-controller/DeploySparkPAUParallel.s.sol and ConfigureSparkPAUParallel.s.sol are thin wrappers that read the input JSON, pin it to the address registry (proxy, USDC, TokenMessengerV2, Spark Executor, Ethereum ALMProxy), and call the library.
Inputs in script/input/42161/, a deployments/arbitrum-production.json template, and Makefile targets deploy-arbitrum-parallel-production, configure-arbitrum-parallel-production, plus simulate-* and test targets.

Nothing touches the ALMProxy. The CONTROLLER grant and rate limits are left to the spell, as you specified.

Verification
Fork end-to-end test (test/parallel-controller/arbitrum/E2E.t.sol) runs the library as the deployer on an Arbitrum fork, asserts the end state, then simulates the spell as the Spark Executor and pushes a real 1M USDC burn through Circle's TokenMessengerV2 via the relayer. It also checks the kill switch, that the deployer keeps no authority, and that unset limits fail closed. 11 of 11 pass.
Wiring diff confirms the Arbitrum wiring is identical, wire for wire, to the CCTP_FACET integration on the Spark Ethereum Beacon.
Forge simulation of the deploy script with the production input completed against the live fork and exported the address file.
Post-deploy test (PostDeployTests.t.sol) asserts state and Arbiscan event logs once the deployments file is filled in. It skips until then.

The OZ submodule issue did not appear; Beacon, facets and factories compile here as is. I did not remove spark-vaults-v2.

Before you broadcast
Deployer address. Both input files use the mainnet deployer 0xC758…136f. Change it if Arbitrum uses a different key. The deploy script refuses any other sender.
Grantor. Set to 0x4B61…C514, which exists at the same address on Arbitrum. Confirm that is the intended Safe.
After deploy, paste controller and administeredAgent from the output file into the config input, then run configure. Then fill deployments/arbitrum-production.json and run make test-postdeploy-arbitrum-parallel.
Env: ARBITRUM_ONE_RPC_URL, ARBISCAN_API_KEY for --verify, ETHERSCAN_API_KEY for the event tests.

Run order:

make test-e2e-arbitrum-parallel
make simulate-deploy-arbitrum-parallel-production
make deploy-arbitrum-parallel-production

Say the word and I will commit and open the PR.