- Add TransferMCMSOwnershipToTimelock changeset: transfers ownership of
  Bypasser, Canceller, Proposer ManyChainMultiSig to RBAC Timelock
  (excludes CallProxy), builds acceptOwnership MCMS proposal. Supports
  migration (existing chains) and new chains after deploy_timelock.
- Add RenounceTimelockDeployerChains changeset: renounces deployer/KMS
  ADMIN role on RBAC Timelock per chain so only Timelock is admin.
- Extend vault types with TransferMCMSOwnershipToTimelockConfig and
  RenounceTimelockDeployerChainsConfig; add validation for both.
- Update README: document durable pipeline flow (new vs migration),
  YAML payload templates, how to run (CI + local), and that
  set_mcms_config in prod_mainnet uses proposal path post-migration.

Co-authored-by: Cursor <cursoragent@cursor.com>