Deploy Stage7702Module with a zero default checkpointer

[Agusx1211]

The deploy script never deployed Stage7702Module, so its DEFAULT_CHECKPOINTER constructor argument was still an open choice. This adds the deployment right after Stage1Module and reads the value from ERC7702_DEFAULT_CHECKPOINTER, defaulting to address(0). The address used is logged, and .env.sample documents that leaving the variable empty gives address(0).

The default matters because Stage7702Auth commits that address into the counterfactual 1-of-1 configuration that every fresh EIP-7702 wallet starts with. With a non-zero value, the first signature of every fresh wallet has to carry the checkpointer flag and BaseSig.recover calls snapshotFor on that contract. If the call reverts, or returns a snapshot whose image hash differs from the counterfactual one, recovery reverts with UnusedSnapshot and the wallet cannot execute, validate ERC-1271 signatures or pass ERC-4337 validation until its configuration is replaced. It can only block, never forge, since the image hash still comes from the signature. The natspec on DEFAULT_CHECKPOINTER and the constructor now spells this out, including that a checkpointer, if one is ever required, must not revert and must return an empty snapshot for wallets it does not know. No contract logic changed.

forge build passes and the deploy script compiles. forge test --match-path test/Factory.t.sol passes, 3 tests, as a build health check; the rest of the suite needs an external RPC server so I did not run it. I checked vm.envOr directly and both an empty and an unset ERC7702_DEFAULT_CHECKPOINTER resolve to address(0), while a real address is picked up. I did not run an actual deployment.