feat(chain): canonical Lux primary L1 chain.yaml (#10)

Source-of-truth declaration for the Lux Network: a sovereign primary
L1 with 11 chains under one networkID per env (1/2/3 for
mainnet/testnet/devnet). Hosts L2 children (Hanzo, Zoo) that opt in
via primary-network staking.

Model:
  Network (this file's `network` block) is the sovereign primary L1.
  Chains live under it; CreateChainTx(networkID, vmID, genesis) each.
  All chains share the Lux validator set and the same networkID.

Spelled out:
- networkID (uint32) vs evmChainID (uint64) — distinct fields at
  distinct scopes; Lux deliberately keeps them different (mainnet
  networkID=1, C-Chain evmChainID=96369), unlike single-brand forks
  (<tenant> / Pars / Osage) that match by convention.
- Lux chain set: P + X + C + Q + Z + A + B + D + G + K + T.
- Minimum required for a Lux primary is P + Q + Z (per the PQZ
  design); the rest are opt-in but ship in stock mainnet today.
- L2 children listed for inventory only; canonical spec lives in
  each L2's own brand universe.

Per-env identifiers sourced from lux/genesis/configs/<env>/{network,
*chain}.json — single source of truth.

chain.yaml

@@ -0,0 +1,221 @@
+version: "1"
+
+# Lux primary L1 — the sovereign Lux Network.
+#
+# Hosts L2 children (Hanzo, Zoo) that opt in to Lux's validator set
+# via primary-network staking. Each L2 lives under its own brand
+# universe (~/work/hanzo/universe, ~/work/zoo/universe) and declares
+# `network.parent: lux` in its own chain.yaml.
+#
+# Model:
+#   Network (this file's `network` block) IS the sovereign primary L1.
+#   Chains live under it (the `chains` list). All chains share the
+#   same Lux validator set and the same networkID per env.
+#
+#   CreateNetworkTx → networkID (1 / 2 / 3 per env)
+#   CreateChainTx(networkID, vmID, genesis) × N → primary chains
+#
+# This is the canonical template; sovereign-L1 forks copy this shape:
+#   ~/work/liquidity adds the  / DEX / FHE chain set
+#   ~/work/pars      adds parsEVM / DEX / FHE + SessionVM
+#   ~/work/osage     same 3-chain shape
+#   ~/work/spc       single-EVM-chain shape
+# L2 forks (Hanzo, Zoo) declare `network.parent: lux` and ride the
+# Lux validator set; they don't redefine `networks[*].validators`.
+
+network:
+  name: "Lux"
+  slug: lux
+  type: l1
+  # Parent is null — Lux is the sovereign primary L1.
+  parent: null
+  validators: 21
+  dbType: zapdb
+  compression: zstd
+
+# Per-env primary networkID (uint32). Each env is its own sovereign
+# Lux Network with its own validator set. The networkID is the
+# on-wire identifier — same number across every chain in that env.
+#
+# `networkID` ≠ `evmChainID`. They are distinct fields at distinct
+# scopes:
+#   - networkID (uint32) : validator-network / P2P handshake / P-Chain
+#                          wire / `--network-id` flag
+#   - evmChainID (uint64): EIP-155 / EVM tx signing / `eth_chainId` /
+#                          MetaMask
+#
+# Lux keeps them deliberately separated (mainnet networkID=1, C-Chain
+# evmChainID=96369) — single-brand forks (Liquidity, Pars, Osage)
+# pick the same number for both by convention; Lux does not.
+#
+# Source of truth for the per-env numbers:
+#   lux/genesis/configs/{mainnet,testnet,devnet}/network.json
+#   lux/genesis/configs/{mainnet,testnet,devnet}/*chain.json
+networks:
+  mainnet:
+    networkId: 1
+    validators: 21
+    imageTag: "latest"
+    rpcUrl: "https://api.lux.network"
+    wsUrl: "wss://api.lux.network/ws"
+    snapshotInterval: 3600
+  testnet:
+    networkId: 2
+    validators: 11
+    imageTag: "latest"
+    rpcUrl: "https://api.lux-test.network"
+    sybilProtection: false
+    snapshotInterval: 1800
+  devnet:
+    networkId: 3
+    validators: 5
+    imageTag: "latest"
+    rpcUrl: "https://api.lux-dev.network"
+    sybilProtection: false
+
+# Chains under the Lux primary network. Each gets its own chainID
+# (ids.ID, output of CreateChainTx). EVM-flavor chains also carry
+# an evmChainID (EIP-155). All chains share the Lux validator set.
+#
+# Minimum required for a Lux primary is P + Q + Z (per
+# ~/work/lux/consensus and the PQZ design). Everything else is opt-in
+# but ships in stock mainnet/testnet/devnet today.
+chains:
+  - name: P
+    vmType: pvm
+    description: "Platform — validator + L1/chain registry"
+    genesisFile: "./genesis/configs/{env}/pchain.json"
+
+  - name: X
+    vmType: xvm
+    description: "Asset transfer — UTXO chain"
+    genesisFile: "./genesis/configs/{env}/xchain.json"
+
+  - name: C
+    vmType: evm
+    description: "Contract — primary EVM"
+    evmChainIds:
+      mainnet: 96369
+      testnet: 96368
+      devnet:  96370
+    rpcPath: "/ext/bc/C/rpc"
+    wsPath:  "/ext/bc/C/ws"
+    genesisFile: "./genesis/configs/{env}/cchain.json"
+
+  - name: Q
+    vmType: qvm
+    description: "Quantum — Quasar PQ consensus rollup"
+    evmChainIds:
+      mainnet: 96569
+      testnet: 96568
+      devnet:  96570
+    genesisFile: "./genesis/configs/{env}/qchain.json"
+
+  - name: Z
+    vmType: zvm
+    description: "Zero-knowledge / rollup substrate"
+    evmChainIds:
+      mainnet: 96969
+      testnet: 96968
+      devnet:  96970
+    genesisFile: "./genesis/configs/{env}/zchain.json"
+
+  - name: A
+    vmType: aivm
+    description: "AI — verification + attestation"
+    evmChainIds:
+      mainnet: 96669
+      testnet: 96668
+      devnet:  96670
+    genesisFile: "./genesis/configs/{env}/achain.json"
+
+  - name: B
+    vmType: bridgevm
+    description: "Bridge"
+    evmChainIds:
+      mainnet: 96769
+      testnet: 96768
+      devnet:  96770
+    genesisFile: "./genesis/configs/{env}/bchain.json"
+
+  - name: D
+    vmType: dexvm
+    description: "DEX — orderbook + matching"
+    evmChainIds:
+      mainnet: 96469
+      testnet: 96468
+      devnet:  96470
+    genesisFile: "./genesis/configs/{env}/dchain.json"
+
+  - name: G
+    vmType: graphvm
+    description: "Graph — indexer / GraphQL"
+    evmChainIds:
+      mainnet: 97069
+      testnet: 97068
+      devnet:  97070
+    genesisFile: "./genesis/configs/{env}/gchain.json"
+
+  - name: K
+    vmType: keyvm
+    description: "Key — KMS / MPC key registry"
+    evmChainIds:
+      mainnet: 97169
+      testnet: 97168
+      devnet:  97170
+    genesisFile: "./genesis/configs/{env}/kchain.json"
+
+  - name: T
+    vmType: thresholdvm
+    description: "Threshold — MPC/FROST/CGGMP ceremonies"
+    evmChainIds:
+      mainnet: 96869
+      testnet: 96868
+      devnet:  96870
+    genesisFile: "./genesis/configs/{env}/tchain.json"
+
+token:
+  name: "Lux"
+  symbol: "LUX"
+  decimals: 9
+  supply: "1000000000000000000000000000"
+
+brand:
+  displayName: "Lux"
+  legalEntity: "Lux Industries Inc."
+  primaryColor: "#000000"
+  logo: "./brand/lux.svg"
+  domains:
+    explorer: "explorer.lux.network"
+    docs: "docs.lux.network"
+    rpc: "api.lux.network"
+
+# L2 children that opt into Lux's validator set via primary-network
+# staking. Each L2 lives in its own universe and declares
+# `network.parent: lux`. Listed here for inventory only — the
+# canonical spec for each L2 is in its own brand universe.
+children:
+  - name: hanzo
+    type: l2
+    repo: github.com/hanzoai/universe
+  - name: zoo
+    type: l2
+    repo: github.com/zooai/universe
+
+precompiles:
+  - name: cggmp21Verify
+    blockTimestamp: 0
+  - name: frostVerify
+    blockTimestamp: 0
+  - name: coronaThreshold
+    blockTimestamp: 0
+  - name: mldsaVerify
+    blockTimestamp: 0
+  - name: slhdsaVerify
+    blockTimestamp: 0
+  - name: mlkemEncap
+    blockTimestamp: 0
+  - name: blake3Config
+    blockTimestamp: 0
+  - name: dexConfig
+    blockTimestamp: 0