feat: record first announcement time in OrderRegistrator

[deacix]

Extracted from #430 per review feedback (split by repo; Fusion-specific auction mechanics move to fusion-protocol). This PR is the only limit-order-protocol change the anchored auction needs.

What

OrderRegistrator.registerOrder keeps its exact master semantics — permissionless, ECDSA/ERC-1271-validated, OrderRegistered(order, extension, signature) emitted on every call — and additionally records announcedAt[orderHash] = block.timestamp on the first registration. The timestamp is write-once: repeated registrations re-emit the event (re-broadcast, as today) but can never move the recorded time.

IOrderRegistrator gains one view:

function announcedAt(bytes32 orderHash) external view returns (uint256 timestamp);

Why

A Fusion auction starts at an absolute timestamp baked into the order at build time; a maker that signs slowly (a multisig collecting signatures) misses its own auction window and degrades to the floor price. The announcement-anchored auction extension — now open as fusion-protocol#223, inheriting the auction base extracted from SimpleSettlement — starts the schedule from announcedAt instead. This contract is the anchor's source of truth, and the write-once rule is what makes the anchor trustworthy: nobody can restart an auction by re-announcing.

Notes

• No protocol changes; no redeploys. The updated registrator deploys at a new address; the existing one keeps serving legacy announcements. deploy-helpers.js now refuses to deploy OrderRegistrator without an explicit create3 salt, since the default salt resolves to the already-occupied address.
• SafeOrderBuilder is untouched and works as-is against the new registrator. One ops note: a SafeOrderBuilder instance wired to the old registrator keeps announcing fine but records no anchor, so an anchored-auction order announced that way fails closed at fill (OrderNotAnnounced) — Safe flows that want anchoring must go through the new registrator (a rewired SafeOrderBuilder or the MultiSend batch directly).
• New tests cover: first-write recording, write-once under re-registration, third-party relay of a signed announcement, the SafeOrderBuilder flow, a Safe announcing via one MultiSend batch (SignMessageLib.signMessage + registerOrder with an empty signature validated through ERC-1271 — the pattern SafeOrderBuilder already uses internally), and the negative gate: an empty signature for a contract maker that has not presigned reverts BadSignature.
• Carries the one-line deploy-Permit2Proxy.js lint fix (getNamedAccounts was not destructured), which yarn lint fails on at master; kept as a separate commit.

Verification

yarn lint clean; full suite yarn test:ci green (179 passing); coverage on OrderRegistrator.sol is 100% statements/branches/functions/lines; docs regenerated for the touched interface only.

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!