Make the dApp deployable into a stack it did not start

[acedward]

What

Four opt-in integration knobs so this repo can be consumed by a compose stack that brings up its own chain, deploys the contract once per bring-up, and serves the dApp from an image built long before. Every knob defaults to today's behaviour.

Knob	Where	What it does
window.SHIELDED_NIGHT = { UNDEPLOYED_ADDRESS: "…" }	the SPA — overwrite the built dist/config.js, which index.html now loads before the bundle	overrides the built-in contract address at RUNTIME, per network
MN_INDEXER_URL, MN_INDEXER_WS_URL, MN_NODE_URL, MN_PROOF_SERVER_URL	networkFor() → deploy / deploy-and-lock / lock / verify-deployment + the integration suite	dial a stack that is not on 127.0.0.1 (compose service hostnames, non-default ports)
MN_EXTERNAL_STACK=1	test/integration/global-setup.ts	run the suite against an already-running stack instead of booting one with testcontainers
DEPLOY_OUT=<path>	scripts/deploy.ts, scripts/deploy-and-lock.ts	also write the deploy as JSON, published atomically

Plus one unrelated repair that CI needed either way (second commit, see below).

Why

The three gaps are exactly what stops a stack-hosted deployment today:

1. The contract address is build-time only (UNDEPLOYED_ADDRESS via Vite's envPrefix), but a stack only learns its address after its own deploy. contractAddressFor() now resolves per call from window.SHIELDED_NIGHT.<NETWORK>_ADDRESS, falling back to the build-time value; blank counts as absent, so a bundle built with an empty UNDEPLOYED_ADDRESS gains "Local (undeployed)" the moment one is injected. Only ADDRESSES are injectable — the wallet still supplies the indexer/node/proof URLs, so there is no URL lane to get wrong.
   index.html now loads /config.js as a classic script (it runs before the deferred module bundle) and public/config.js ships a no-op placeholder, so every deployment serves a real file. Without the placeholder a static host would answer /config.js with a 404 or an HTML SPA fallback the browser refuses to execute, and a stack-hosted image would have had to edit built output to add the tag — the kind of patch this change set exists to avoid. A deployment now overwrites that one file and touches nothing else.
2. The undeployed URLs were hard-coded to 127.0.0.1, which a container on the same docker network cannot reach at all. The four overrides fix that for every script through one resolution point. On the HOSTED envs only MN_PROOF_SERVER_URL applies, deliberately: the indexer/node URLs identify the network itself, and silently repointing preview because a local-stack variable was left exported would be an expensive, invisible bug. (The hosted configs hard-coded a local proof server, so that one is worth overriding.)
3. The integration suite always started its own stack, so a packaging of this dApp could only be gated by a transcribed driver. MN_EXTERNAL_STACK=1 lets THIS suite be the gate. It never tears down what it did not start, and it preflights the endpoints so a wrong URL fails immediately, by name, instead of ten minutes later as a wallet-sync timeout.

DEPLOY_OUT is the small fourth piece: scraping the address off stdout in a one-shot container is fragile, so the same run can also write {address, networkId, name, symbol, decimals, deployedAt, commit, locked} atomically (temp + rename). commit comes from SHIELDED_NIGHT_COMMIT (an image built from a pinned SHA has no .git), else git rev-parse HEAD, else null.

The CI repair (commit 2)

CI has been red on main since bun 1.4.0 shipped — every job that installs the ROOT dependencies dies at bun install --frozen-lockfile with "overrides in package.json changed since bun.lock was saved". overrides carried its explanation as a "//" key, which bun no longer counts as an override, so the saved lockfile no longer matches. frontend/, whose overrides have no such key, installs fine on 1.4.0 — which isolates the cause. The note moves to a top-level //overrides key and the stale line leaves the lockfile.

Measured with the official images against a pristine main: bun install --frozen-lockfile fails on oven/bun:1.4.0 and passes on 1.3.11; after the fix it passes on 1.2.23, 1.3.11 and 1.4.0, leaving both lockfiles byte-identical. The lockfile diff is that one line — no package resolution changes.

How it was verified

• bun run compact:fast + bun run typecheck + bun run test:unit → 78 passed (23 new; was 55). The new unit files pin: build-time fallback, injected-wins, blank/trim handling, per-network isolation; all four overrides on undeployed and proof-server-only on hosted; DEPLOY_OUT unset ⇒ nothing written, set ⇒ one complete file and no temp left behind.
• frontend: bun install --frozen-lockfile (root AND frontend, as CI does), bun run typecheck, bun run build — green; dist/ carries config.js and index.html references it.
• Minification marker measured in dist/assets/index-*.js: …(t=typeof window>"u"?void 0:window)=>{const e=t?.SHIELDED_NIGHT;…}, so a downstream image's guard is grep -q SHIELDED_NIGHT dist/assets/*.js.
• bun run compact (full ZK, compactc 0.31.1) reproduced src/managed/ byte-for-byte locally, as CI's rebuild job also asserts.
• The whole point, exercised end to end: a devnet was brought up by hand on random ports (node 57085 / indexer 57165 / proof 57086 — none of the defaults) and MN_EXTERNAL_STACK=1 MN_ENV=undeployed MN_INDEXER_URL=… MN_INDEXER_WS_URL=… MN_NODE_URL=… MN_PROOF_SERVER_URL=… bun run smoke passed 4/4 smoke tests (deploy + metadata, the full two-step round trip, two-user independence, and the atomic single-transaction convert pair) without starting a container, and left the stack running on teardown. On that same stack, DEPLOY_OUT=…/contract.json bun run scripts/deploy.ts wrote the record (parent directory created, commit resolved from git), and verify-deployment.ts reached the overridden indexer and matched 11/11 verifier keys byte-for-byte on chain.
• Pointed at dead ports, the suite fails in global setup naming all three unreachable URLs, and starts nothing.

Non-breaking

Every knob is opt-in and unset means today's behaviour. frontend/.env is untouched, no dependency changed (the only lockfile edit is the stale comment line above), and src/shielded-night.compact and src/managed/ are not touched at all, so the byte-exact-rebuild claim is unaffected.

Docs

README.md ("Deploying into a stack you already have"), frontend/README.md ("Runtime address override"), TESTING.md (env-var table + "Running against a stack you already have").