[CHORE] mainnet: bake the CommitmentRegistry address

[liorbond]

Replaces the TBD placeholder in src/envs/mainnet.toml with the CommitmentRegistry deployed on Arbitrum One (chain 42161): 0x4B82F827C03fad5739EFEcfcF743E65E732be695. One registry serves both host chains (Ethereum, Arbitrum One).

Read from the chain at the time of this PR: default admin is the mainnet Safe and sole role holder, commitment version 2 is Active and version 1 is not, size 0, one poster registered. The gate stays ON and ENFORCING as before: a fresh registry with only v2 has nothing to grandfather, so there is no warn-only period.

Tests: the mainnet config test now asserts the real address instead of TBD; a new mainnet_policy_is_commitment_enforcing mirrors the staging/testnet policy tests (address, version, enforcing, TaskManager id 1 for chains 1 and 42161).

Deployment notes:

• The policy is baked into the image, so this needs a rebuild and the partners' reader re-pin to the new digest before a mainnet boot.
• COMMITMENT_REGISTRY_RPC_URL (an Arbitrum One endpoint) still comes from the mainnet tfvars; boot fail-closes without it.
• Because the gate enforces, the commitment poster pipeline must be live on Arbitrum One before TaskManager intake is enabled, or every decrypt is refused.

🤖 Generated with Claude Code