init eco traders veVirt feature

[koo-virtuals]

Note

High Risk
Changes core token-locking/voting-power accounting and introduces a new Merkle-claim flow that moves funds and uses custom assembly proof verification; mistakes could mis-allocate voting units or enable incorrect claims/staking.

Overview
Introduces eco-trader staking by extending veVirtual with a per-user ecoLocks mapping and stakeEcoLockFor() to create/accumulate an auto-renewing max-duration lock; these eco locks now contribute to balanceOfAt()/stakedAmountOf() and emit EcoLockUpdated.

Adds a new CumulativeMerkleDrop (ICumulativeMerkleDrop) contract that owner-updates a cumulative merkleRoot and lets anyone submit proofs to claim the delta since last claim, then immediately approve and stake the tokens into veVirtual via stakeEcoLockFor() (plus an owner adminWithdraw).

Updates tooling and ops: adds merkletreejs/keccak256 deps, new deploy/upgrade/test scripts for eco traders, adjusts deployVeVirtual.ts (maxWeeks 104, grants roles post-deploy), adds a comprehensive eco-trader test suite, and updates .openzeppelin/base-sepolia.json storage layout entries to reflect the new state variables.

^{Written by Cursor Bugbot for commit 2408e43. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

stakeEcoLockFor lacks access control, allowing unauthorized eco locks

Medium Severity

stakeEcoLockFor has no access control, unlike other privileged functions in the contract that use onlyRole(ADMIN_ROLE). Anyone can call it to create permanent, non-withdrawable eco locks for any account, giving that account unwanted voting power. This also bypasses the merkle proof verification that CumulativeMerkleDrop provides. The function likely needs a role restriction so only authorized contracts (like the merkle drop) can create eco locks.