docs(active-evm): add README and task-origin signing guide

Documents the active/evm shared-project layout, how tasks run against the
shared Foundry setup, and the task-origin signing flow. Written generically
(no task-specific references) so it stands alone with the foundation.

Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

Author: 0xth4nh

active/evm/README.md

@@ -0,0 +1,60 @@
+# Active EVM Tasks
+
+Active EVM tasks live under `tasks/<task-id>/`. Shared Foundry setup and reusable
+scripts stay at this `active/evm` root so multiple active tasks can use the same
+`script/common/<category>/` implementations.
+
+## Layout
+
+```text
+active/evm/
+├── foundry.toml
+├── script/
+│   └── common/
+│       ├── bridge/
+│       ├── funding/
+│       ├── gas/
+│       ├── ownership/
+│       ├── safe/
+│       ├── superchain/
+│       └── verifier-update/
+└── tasks/
+    └── <YYYY-MM-DD-task-name>/
+        ├── Makefile
+        ├── FACILITATOR.md
+        └── config/
+            └── <network>/
+                ├── .env
+                ├── network.env
+                ├── README.md
+                ├── validations/
+                └── signatures/
+```
+
+Shared, repo-wide infrastructure (toolchain bootstrap, `deps`, signer-tool
+checkout, task-origin signing targets) lives in the root `Makefile` and
+`Multisig.mk`, which each task Makefile includes.
+
+## Running a task
+
+Each task ships its own `Makefile` under `tasks/<task-id>/` that selects the
+task/network and wires the relevant `script/common` script. Run task commands
+from `active/evm`:
+
+```bash
+cd active/evm
+make deps
+make gen-validation-cb
+make gen-validation-sc
+```
+
+The root Makefile runs Forge from `active/evm` (shared `foundry.toml` and `lib/`),
+while task-specific files are read from `tasks/<task-id>/config/<network>/`. The
+signer tool discovers date-prefixed task directories containing
+`config/<network>/validations`. Task-origin signatures, when required, live under
+`tasks/<task-id>/config/<network>/signatures/` (see `TASK_ORIGIN.md`).
+
+## Common scripts
+
+Reusable operation scripts live under `script/common/<category>/` and are shared
+across tasks. See `script/common/README.md` for the inventory and conventions.

active/evm/TASK_ORIGIN.md

@@ -0,0 +1,40 @@
+# Task Origin Signing
+
+Task origin signatures prove who created and facilitated the task. They are
+stored with each network config under
+`active/evm/tasks/<task-id>/config/<network>/signatures/`.
+
+The signatures cover `active/evm/tasks/<task-id>/config/<network>`, excluding the
+`signatures/` directory itself, so any change to `.env`, `network.env`, or the
+validation files after this step requires regenerating them.
+
+Task-origin validation is enabled by default. A task may opt out by setting
+`skipTaskOriginValidation: true` at the root of each validation file (for
+example, non-production networks that do not require origin signatures).
+
+Run these commands only after the network config is final. Select the task with
+`TASK_ID` / `TASK_NETWORK`:
+
+## Task Creator
+
+```bash
+cd active/evm
+make deps
+TASK_ID=<YYYY-MM-DD-task-name> TASK_NETWORK=<network> make sign-as-task-creator
+```
+
+## Base Facilitator
+
+```bash
+cd active/evm
+make deps
+TASK_ID=<YYYY-MM-DD-task-name> TASK_NETWORK=<network> make sign-as-base-facilitator
+```
+
+## Security Council Facilitator
+
+```bash
+cd active/evm
+make deps
+TASK_ID=<YYYY-MM-DD-task-name> TASK_NETWORK=<network> make sign-as-sc-facilitator
+```