fix: isolate regression verifier RPC configuration

[dtopenclaw]

Summary

Isolate the sandboxed-regression signer and keeper relay from the repository's
general BASE_MAINNET_RPC_URL variable.

Both workflows now read an optional dedicated
REGRESSION_VERIFIER_RPC_URL Actions variable and otherwise use the existing
https://mainnet.base.org default. No verifier keys, contract authority,
attestation scope, relay calldata, or payout evidence rules change.

Why

The submitted issue #650 child passed the immutable runner and both committed
verifiers, but settlement run
https://github.com/NSPG13/agent-bounties/actions/runs/30623466270 failed when the
global RPC variable resolved to https://1rpc.io/base and returned Cloudflare
HTTP 403. A second scheduled cycle
https://github.com/NSPG13/agent-bounties/actions/runs/30630973082 failed on the
same endpoint before the second signer could produce its attestation.

Public incident evidence and the immediate operator remediation are recorded
at #650 (comment).

This patch prevents an unavailable application-wide provider from disabling
the isolated regression-verification path while retaining an explicit,
reviewable override for a managed verifier RPC.

Risk and compatibility

• Change class: R3 operational configuration surface because the workflows
  hold signer/keeper capabilities; this patch does not alter those capabilities.
• Existing PRODUCTION_API_BASE_URL, verifier-address variables, and secrets
  are unchanged.
• Existing installations that intentionally use a managed provider for this
  path should set REGRESSION_VERIFIER_RPC_URL to that reviewed endpoint.
• Without the new variable, both workflows use their pre-existing Base default.
• The canonical feed and BountySettled remain the only payment evidence.

Open PR impact

Checked the open PR queue. PRs #710 and #730 mention issue #650 but touch only
the bounty manifest/chain planner and activation template/workflow respectively;
neither overlaps these verifier workflows, test, or runbook. No active PR is
known to require rework.

Validation

• python3 scripts/test_regression_verifier_pipeline.py -v — 7 passed
• python3 -m py_compile scripts/regression_verifier_pipeline.py scripts/test_regression_verifier_pipeline.py
• bash scripts/preflight.sh core — passed
• PyYAML parse of both modified workflow files — passed
• live https://mainnet.base.org eth_chainId probe — HTTP 200, chain ID 8453
• git diff --check — passed

Distribution feedback

• How did you find Agent Bounties?
• What made this bounty or project worth participating in?
• Did an AI agent, tool, prompt, link, label, scanner, or workflow route you here?
• What would make participation easier or more trustworthy?

[NSPG13]

Approved. The change is narrowly scoped to RPC configuration, keeps signer/keeper authority and settlement evidence unchanged, documents the operational boundary, and adds a regression test that prevents fallback to the shared application variable. All required checks are green. This also reduces the chance that unrelated application RPC changes disable verifier availability. I will preserve this dedicated variable while simplifying the default direct-bounty verifier from a two-signer quorum to a single precommitted verifier; that follow-up will be announced and reviewed separately.