ROHME-11: install LpBondLister so new LP bonds no longer need a vote

ROHME-11: install LpBondLister so new LP bonds no longer need a vote REFILED. Supersedes ROHME-4, defeated on turnout (0 FOR against a 1,000 gROHM quorum), not on merits. The action is identical; this copy files on the LIVE V1 governor in parallel with the ROHME-7 migration vote: it needs 1,000 gROHM FOR within 5 days. If turnout defeats it again, it refiles on Governor V2 — where quorum is reachable — as soon as the migration executes. Voting for it here costs nothing and may land it a week earlier. The lister's timelock reference is mutable precisely so the V2 migration does not strand it — the Timelock address itself is unchanged by ROHME-7, so no re-pointing is needed. THE PROBLEM. Adding a single LP bond asset currently costs a full governance cycle. ROHME-10 spends an entire decree registering two pairs. There are 37 approved reserves, so at one decree per pair this does not scale. WHAT THIS DOES. 1. Authority.pushGovernor(0x5c288FfD4E766C8932E62F064A463380b39C89f4, effectiveImmediately=false) `false` means only `newGovernor` is set, leaving the Timelock as the live governor; the lister then claims the role through its own permissionless acceptGovernor(). After that, listing ROHM/SNDK - or any other approved reserve - is a single operator transaction. WHY THIS IS NOT A GENERAL LOOSENING OF THE MINT PERMISSION. setPriceFeed + enable(RESERVETOKEN) IS the mint permission: an arbitrary token with a lying feed can be deposited to mint ROHM against nothing. This contract does not open that for arbitrary assets. It opens it for a strictly DERIVED class where the caller supplies no trusted input at all: - the paired token must ALREADY be an enabled RESERVETOKEN that governance vetted, and must NOT itself be a Uniswap pair (checked structurally against the canonical factory, so an LP that governance registered directly - such as the genesis POL - is also rejected); - the aggregator is read from the Treasury's OWN registry for that token, never passed in; - the pair address is resolved through the canonical factory, so no look-alike can be substituted; - the valuation feed is deployed BY the contract, so its bytecode cannot lie; - heartbeat and the ERC-8056 pause flag are inherited from the approved config, and the haircut is max(inherited, 2000 bps) - never looser than the leg. The operator's only degree of freedom is WHICH governance-approved reserve to pair with. Listing is also inert on its own: it makes an LP depositable, but PolicyGuard.createMarket (onlyOperator) still has to price a market before anything can be minted. GOVERNANCE LOSES NOTHING. relay(target, data) lets the Timelock execute any call this contract could make, so every power governance holds today it still holds afterwards, routed through here. Governance can also hand the governor role back, rotate the operator (2-step), re-point the contract at a new Timelock, and delist a pair. AUDIT HISTORY. This contract was audited and four findings are fixed in the deployed bytecode: the anti-nesting guard is now structural rather than local bookkeeping (the previous version let the genesis ROHM/WETH POL LP, registered directly by governance and therefore invisible to that bookkeeping, be paired into a doubly self-referential nested LP); a governance de-listing is no longer reversible by the operator; relay rejects a code-less target instead of silently succeeding and reporting success to the Timelock; and the timelock reference is no longer immutable, which would otherwise have stranded governor power inside this contract after the governor migration. ONE RESIDUAL RISK, NOT FIXED. The LP valuation requires the paired token to be HOOKLESS - a transfer callback opens a read-only-reentrancy window during Uniswap's burn() that inflates the per-LP mark. Governance vetted each leg as a RESERVE, a review that never asked about transfer hooks, and this contract cannot check for it. The 4x price band caps the exposure to a PriceOutOfBounds skip rather than an over-mint. If a hook-bearing token is ever approved as a reserve, this path should first be gated behind an explicit hookless allowlist. Note also that the equity tokens are upgradeable beacon proxies, so hooklessness is not a permanent property. This is a real transfer of a sensitive permission to a contract. Vote against it if you would rather each LP listing keep costing a decree.