[parasgarg-bitgo]

Summary

Full RPC liveness audit of all 121 remote networks in hardhat.config.ts (tracked in CECHO-2476). This PR replaces 5 dead/misconfigured RPC URLs, moves 8 secret-backed RPC URLs to public endpoints, adds chainId validation to every remote network, and fixes the swapped BERA/BERA_TESTNET constants.

Problem

• chiliz → rpc.ankr.com/chiliz: Ankr removed keyless access (401 from external probes; docs now require a key)
• bobaeth → boba-ethereum.gateway.tenderly.co and tworld → worldchain-sepolia.gateway.tenderly.co: Tenderly discontinued the free public gateway routes (404 externally)
• phrs → testnet.dplabs-internal.com: DNS repurposed to ZAN infrastructure (serves a *.zan.top TLS cert — deterministic handshake failure); also a mainnet network pointed at a testnet hostname (TODO WIN-5781)
• tcelo → sepolia.celoscan.io: never an RPC — it is the Celoscan explorer website (returns HTML)
• 8 networks loaded RPC URLs from GitHub secrets although verified public endpoints exist
• No chainId on network declarations → Hardhat cannot fail fast if a URL points at the wrong chain
• CHAIN_IDS.BERA held 80069 (Bepolia testnet) and BERA_TESTNET held 80094 (mainnet) — values swapped

Changes

Dead URL replacements (each verified live via eth_chainId, matching config/chainIds.ts):

Network	New URL	chainId
tcelo	https://forno.celo-sepolia.celo-testnet.org	11142220
tworld	https://worldchain-sepolia.g.alchemy.com/public	4801
phrs	https://rpc.pharos.xyz	1672 (resolves TODO WIN-5781)
chiliz	https://rpc.chiliz.com	88888
bobaeth	https://mainnet.boba.network	288

Secret → public RPC URLs: tarbeth → https://sepolia-rollup.arbitrum.io/rpc (421614), topeth → https://sepolia.optimism.io (11155420), opeth → https://mainnet.optimism.io (10), tzketh → https://sepolia.era.zksync.dev (300), bera → https://rpc.berachain.com (80094), tstt → https://dream-rpc.somnia.network (50312), mon → https://rpc.monad.xyz (143), plasma → https://rpc.plasma.to (9745). The orphaned env-var destructuring entries are removed.

chainId guards: chainId: CHAIN_IDS.* added to all 117 networks that lacked one. Hardhat now wraps each provider in ChainIdValidatorProvider, which aborts with NETWORK.INVALID_GLOBAL_CHAIN_ID on the first request if the RPC's chain doesn't match — turning wrong-chain deploys/transfers into immediate hard failures. dogeos is intentionally left unguarded: CHAIN_IDS.DOGEOS is a placeholder (123456, WIN-8075) that would fail validation against the testnet RPC it currently points to.

BERA swap fix: BERA: 80094 (mainnet), BERA_TESTNET: 80069 (Bepolia) in config/chainIds.ts, with the two customChains usages swapped in lockstep so the same numbers keep flowing to the matching Routescan APIs.

Also included: rename the polygonAmoy hardhat network to tmatic (aligns with the network tags the deploy workflows already match on) and map its etherscan verification to POLYGONSCAN_API_KEY.

Verification

• Every new URL probed with POST eth_chainId; all values match config/chainIds.ts
• Consistency check across 121/121 networks (declared chainId vs live-probed value): all pass
• npx hardhat compile clean; npm run lint (prettier) clean
• Runtime validator smoke: tcelo → 11142220, bera → 80094, tbera → 80069 (a mismatch aborts before any request executes)

Out of scope / follow-ups (CECHO-2476)

• Drop the now-unused RPC secret env lines from the 5 workflows that pass them (transfer_batcher_ownership, update_transfer_gas_limit, deploy_and_release, deploy_batcher_contract, push) — deliberately not done in this PR
• Add dogeos chainId once the mainnet RPC exists (WIN-8075)
• Per-chain prerequisites for running transfer-batcher-ownership (deployed Batcher at BATCHER_ADDRESS, current on-chain owner = deployer key, owner-address secrets present in both GitHub environments); for chiliz/bobaeth/tworld/phrs/tcelo, confirm a Batcher is actually deployed on-chain first

Ticket: CECHO-2476

[linear-code]

CECHO-2476