Use supported Etherscan verification for maintained deployments

[mswilkison]

Replace hardhat-deploy's legacy etherscan-verify CI task with @nomicfoundation/hardhat-verify 2.1.3, the supported hh2 release. Configure a single Etherscan API V2 key and verify the four non-staking deployment records emitted by the current scripts: T, VendingMachineNuCypher, TokenholderTimelock, and TokenholderGovernor on mainnet or Sepolia.

The new verify-deployments task reads saved addresses, constructor arguments, and linked libraries, including the VendingMachine and TimelockController aliases. It rejects missing records/arguments before submission, lets the plugin skip already-verified contracts, and propagates verification failures to CI. CI transfers compiler artifacts with the deployment records. Documentation covers commands, scope, historical source requirements, and the retained upgrades dependency.

TokenStaking/proxy verification is excluded per #185. The OpenZeppelin upgrades plugin remains because deployment scripts and proxy/staking tests still use it; #176 and #186 also retain consumer/testnet proxy behavior.

This PR is stacked on #182 (chore/dependency-toolchain-refresh, base 14843ac). Merge #182 first, then retarget to main. Refs #185; supersedes the deprecated-plugin approach in #125.

Validation:

• Frozen install, build, type checking, lint/formatting, prepack, actionlint, and git diff --check pass.
• Full suite: 388 passing, including eight new verification tests. The real plugin matches four fresh local deployments, encodes their actual constructor arguments, and handles replay without another submission or blockchain transaction. Only explorer responses are stubbed.
• Read-only preflight against existing Sepolia T at 0x4f261630173D2FA1e2b081c460636DE9672B7149 confirmed chain ID 11155111, a bytecode match for contracts/token/T.sol:T, compiler 0.8.9+commit.e5eed63a, and the empty constructor argument list.

A live Etherscan submission was not performed: no ETHERSCAN_API_KEY is available in this session. That final authenticated verification check remains for the configured CI environment; the issue should remain open until it succeeds. No public-network deployment or npm publication was performed.