Swap & Bridge OETHb fees to FeeSplitter

[shahthepro]

Base OETHb fees still mint to the 1-of-3 fee Safe 0xBB077E71… (the Base vault's trusteeAddress, 20% fee). Today we swap and bridge them manually. This automates it: the fees reach the mainnet FeeSplitter as WETH and follow the OUSD/OETH fees to xOGN.

• BaseFeeBridgeModule, a Safe module on the fee Safe, operated by Talos. One call, swapAndBridge, sells the Safe's OETHb for WETH on the Curve AMO pool (0x302A…f378) and sends only the WETH that swap produced over CCIP to the FeeSplitter (0xbbE5…0464).
• Guardrails: the pool, the route and the CCIP receiver are fixed at construction, so the operator can't change any of them. The swap must return at least par minus maxSlippageBps (50 bps at deploy). The Safe can change that bound, capped at 100 bps. Since OETHb redeems 1:1, par is a valid floor and no oracle is needed.
• Why a swap and not a vault redeem: a redeem is two steps (request, then claim after the delay once the queue has liquidity), and Talos would have to track request ids. Curve costs about 9 bps today.
• The CCIP fee is flat, about 0.019 ETH per message, whatever the amount. The bridgeBaseFees action therefore waits until bridgeFee() is at most --max-fee-bps (default 100) of the amount, about 2 OETHb today. It simulates before sending, has --dryrun, and fails loudly if the pool is below the floor or the Safe can't pay the fee. The schedule is seeded disabled (45 10 * * *, after the Base rebase and before the 12:10 mainnet feeSplitterDistribute).
• Mainnet side: no FeeSplitter, harvester or setXOGNRewardRate change. The OGN CoW harvester already sells WETH. OGN bought with it arrives through CoW settlement, so the rate setter counts it as buyback income, not a donation.
• Deploy base/007 needs no governance. No Vault or OToken change. The fee Safe already holds the fees, so a module on it was enough; re-pointing a role or adding a new peripheral contract wasn't needed.

Required ops, in this order

1. Mainnet Strategist: FeeSplitter.addAsset(WETH, 0.125e18). Without it, bridged WETH is not distributed and only a Governor rescue gets it out.
2. Base fee Safe: enableModule(<module>), and keep some ETH for CCIP fees.
3. Enable bridge_base_fees in Talos.

Talos impact
007 deploys only the new BaseFeeBridgeModule, recorded as BaseFeeBridgeModule. The only action that uses it is the new bridgeBaseFees: it reads the address from the descriptor make deploy-base writes and uses an inline ABI. No pinned addresses or abi/*.json change, and no existing action is affected. talos-actions-inventory.md is regenerated, which also adds the ousdSusdeV4Rebalance entry missing since #3033.

Testing

• Unit: 26 tests (access control, floor, fixed receiver, only the swapped WETH bridged, fee payment, constructor checks).
• Fork (Base): 3 tests against the live Curve pool and the live CCIP router. They show the Base→Ethereum route accepts a WETH-only message addressed to the FeeSplitter.
• Anvil end to end: the action bridged the Safe's real 1.94 OETHb (fee 98 bps, under the 100 bps limit), then found nothing left on the next run. On a mainnet fork, addAsset(WETH) followed by distribute() moved the WETH on to the harvester.
• Slither: clean apart from one informational naming note. The deliberate before/after WETH read is suppressed with a reason. pnpm test:tasks and typecheck pass.