Add guarded Polygon ManagedOO production upgrade tooling

[md0x]

Summary

• pin the reviewed ManagedOO target build and exact current-production storage reference
• add external-signer implementation deployment plus guarded Safe calldata preparation
• verify current and target bytecode, UUPS immutables, initializer state, roles, configuration, whitelists, balances, and optional reporter wiring
• add a rerunnable post-upgrade verifier and production runbook; the upgrade uses upgradeToAndCall(target, 0x) with no initializeV2

Validation

• 82 unit tests and 17 Polygon fork tests pass
• production fork coverage executes the Safe upgrade and rejects altered UUPS immutables
• OpenZeppelin storage validation and a live Polygon deployment dry-run pass
• target runtime: 24,524 bytes (52-byte EIP-170 margin)
• Forge v1.3.6 formatting and git diff --check pass