E2E: deploy Safe from Rabby EOA and verify deterministic address detection

[premiumjibles]

Goal

Verify that when a Safe is deployed from an EOA (Rabby wallet), the agent deterministically detects/predicts the correct Safe address — proving CREATE2 prediction matches actual deployment.

tk ticket: sa-tmsw

Current State

• Client (safeFactory.ts): predicts with deterministic salt keccak256(encodePacked(['address'], [ownerAddress])), pinned Safe v1.3.0
• Server (predictSafeAddress.ts): identical prediction logic
• Verification (safeAddressVerification.ts): validates ownership for deployed Safes, falls back to prediction-matching for counterfactual
• Zero tests covering any of this logic

Risk

Client and server have duplicate implementations with different provider initialization. If parameters ever diverge, predicted addresses will silently mismatch. Address checksum normalization differences could produce different salts.

Test Plan

1. Unit tests for predictSafeAddress: idempotency, uniqueness per owner, cross-chain consistency
2. Unit tests for verifySafeOwnership: deployed owner match, counterfactual match, ownership mismatch
3. Manual E2E: Rabby EOA → predict → deploy → verify address matches prediction
4. Parity check: verify client and server produce identical addresses

Key Files

• apps/agentic-server/src/utils/predictSafeAddress.ts
• apps/agentic-server/src/utils/safeAddressVerification.ts
• apps/agentic-chat/src/lib/safe/safeFactory.ts

Acceptance Criteria

• Unit tests for predictSafeAddress
• Unit tests for verifySafeOwnership
• Manual E2E verification with Rabby
• Client/server parity verified