PC-09: transfer proxy ownership to TimelockController + Safe multisig

[dantaik]

Context

The DeepSeek PC-09 finding (the last Open item in the legacy audit reconciliation) tracks proxy ownership. As of the readiness review:

• On-chain owner() of both PaymentChannel and Adjudicator proxies is the deployer EOA 0x327fa3369B1D1D42120d84bc407e5865ECa7c458 (per the README).
• Deploy scripts are correct (packages/contracts/script/DeployTimelock.s.sol enforces 48h min delay; TransferOwnership.s.sol validates that the new owner is a contract with the right interface), but they haven't been run on mainnet.
• A single key compromise today permits unilateral token allowlist changes, min-amount resets, or a malicious UUPS upgrade.

Acceptance criteria

• Safe multisig deployed and confirmed on Taiko mainnet, with the agreed signer set + threshold.
• DeployTimelock.s.sol executed; resulting TimelockController address recorded with getMinDelay() == 172800 verified on Taikoscan.
• TransferOwnership.s.sol executed against both proxies; owner() post-conditions verified on-chain.
• Deployer EOA swept to cold storage and physically retired (private key destroyed or stored offline with documented custody).
• Evidence — tx hashes, owner contract address, Safe signer set, deployer sweep tx — recorded in a fresh launch-evidence note (or appended to the next release notes) and referenced from final_readiness_report.html.

Severity

Critical — GA blocker. No code changes needed; operator-only.

Evidence pointers

• final_readiness_report.html §3.3 SC-02, §13.1 item 2.
• docs/runbooks/ownership-transfer.md (full procedure).
• packages/contracts/script/{DeployTimelock,TransferOwnership}.s.sol.