[Epic] Demo-ready Neo X CLI: NeoFS metadata storage + clean-clone hardening

[thedanielmark]

Context

PR #1 added Neo X T4 ERC-8004 identity registration to this fork: direct viem registration, preflight / register / verify / logs, and resumable state. Do not rewrite that core.

This epic makes the fork safe to hand off from a clean clone, with ERC-8004 metadata stored in NeoFS and the inline data: URI kept as a fallback.

Remaining

• Record one live Neo X T4 + NeoFS registration: public read-back, setAgentURI, verify, and a resume that does not remint.
• Run npm run test:neox in CI. It covers generated inline and NeoFS projects; default npm test currently skips it.

Done when

A clean clone can publish NeoFS metadata, register it on Neo X T4, verify the public URI, and resume without minting twice. Inline metadata still works as a fallback.

Non-goals

• Reputation Registry or Validation Registry.
• x402 on Neo X.
• Reworking the Identity Registry or replacing the resumable registration state machine.
• Provisioning NeoFS or building a gateway. The CLI talks to an existing REST gateway and container.
• Scanner or indexer changes. Missing generic HTTPS metadata support belongs in the scanner repository.
• Publishing an npm package.

Acceptance

Storage and registration

• Inline publication goes through an inline storage adapter. NeoFS is used only when explicitly selected.
• The backend selector is metadataStorage in the generated agent config (inline by default). METADATA_STORAGE is not a selector. NeoFS connection settings stay separate: upload gateway, container id, public HTTPS gateway, and bearer token.
• Nothing is uploaded before agentId is known. An upload or setAgentURI failure does not remint. A saved publication is reused only when its canonical metadata, URI, and backend still match; otherwise it is republished with the same agentId.
• A reverted transaction is recovered on retry. An unknown pending hash is kept and registration stops instead of sending a replacement.
• Credentials, bearer tokens, and private keys are not written to state, result files, logs, errors, or generated docs. .env stays gitignored. The EVM key is not a NeoFS credential.
• NeoFS upload uses the REST gateway, sends the same registration JSON as application/json, keeps container_id and object_id, and sets an HTTPS agentURI (not neofs://). Read-back must succeed and match before setAgentURI. Read-back failure does not change agentURI.
• If NeoFS is unavailable before registration completes, set metadataStorage to "inline" and rerun. Do not delete .registration-state.json.

Generator, verify, and handoff

• Wizard and --config can select NeoFS. Configs that omit the field stay inline. Missing NeoFS endpoint or container settings fail with an actionable error.
• Generated docs explain that metadata lives in NeoFS, the registry stores only the URI, how to configure the gateway and container, and how to run preflight, register, verify, and logs.
• verify checks owner, tokenURI, agent wallet, the eip155:12227332:<registry> registration reference, and the current registration document for both inline and HTTP metadata. Result output includes storage provenance and no secrets.
• Tests do not read ../erc-8004-contracts.
• This fork is not published to npm. repository, bugs, and homepage point at the AxLabs fork. Docs use clone, npm ci, build, and node dist/index.js, and do not tell operators to run npx create-8004-agent.
• docs/neox-t4-demo.md covers a clean checkout through funding, preflight, register, explorer, public GET, verify, logs, resume, and the inline fallback.

Optional, not required to close

• Read-only Neo X T4 smoke check, separate from PR CI: chain id 12227332, Identity Registry bytecode at 0x8004A856a396D08d31E597a867B1D8273901e641, and readable name / getVersion. Keep it non-blocking.
• Richer NeoFS read-back diagnostics, extra object attributes, or wizard polish.