chore: sync sc-feat/opcm2-upgrade-op-chain with develop

[0xiamflux]

Note

Adds upgrade sequence validation to OPContractsManagerV2, replaces constant version with a pure function and internal accessor, and introduces a semgrep rule to enforce using the internal version accessor.

• Contracts (OPContractsManagerV2)
  • Convert version from constant to function version() pure returning "7.0.0"; add _version() internal accessor and replace internal comparisons.
  • Add isPermittedUpgradeSequence(ISystemConfig) with semver-based checks; enforce in _apply for non-initial upgrades.
  • Add error OPContractsManagerV2_InvalidUpgradeSequence(string _lastVersion, string _thisVersion).
  • Update interface IOPContractsManagerV2 and ABI; refresh semver-lock hashes.
• Tooling / Linting
  • Add semgrep rule sol-safety-opcmv2-use-internal-version to require _version() instead of direct version(); add corresponding test case.
  • Make semgrep CI step fail on findings (--error).
• Tests
  • Add comprehensive tests for upgrade sequencing logic and adapt tests to new _version()/version() behavior.
  • Minor test refactors (shared helpers) and cleanup (remove unused v1 import).

^{Written by Cursor Bugbot for commit 5a087eb. This will update automatically on new commits. Configure here.}