fix(ci): unblock m1 CI — merge-base, cached packages, mint delegation, AA genesis

[ganymedio]

Summary

Fixes CI failures that appeared on m1 after #367 restored the build/lint/test workflows. The red checks are several independent problems; this PR fixes all the code-level ones. The one remaining failure (dead infra secret) is documented below.

Fixed here

1. rust-check-merge-base (+ rust-targeted-unit-tests) — two distinct bugs

• Empty merge base on push. identify_merge_base() fell back to origin/main when GITHUB_BASE_REF was unset (push events). This fork's default is m1; the stale origin/main shares no common ancestor, so git merge-base returned "" and the check panicked (ParseError(TooShort)). Fixed by defaulting to m1.
• Stale-base freshness failure on PRs. On pull_request events the merge base resolves fine, but the 7-day freshness check fails whenever the base tip itself is >7 days old. m1 is slow-moving, so every PR failed once m1 went a week without a commit — and rebasing can't help because the merge base is the m1 tip. Fixed by skipping the age check when the merge base equals the base tip (branch is not behind at all).

2. rust-build-cached-packages — stale generated artifacts

cargo build -p aptos-cached-packages produced an uncommitted diff. Regenerated:

• staking_contract.md — [Framework] Disallow setting beneficiary to @vm_reserved #380 (@vm_reserved beneficiary check)
• features.md — fix(features): add allow serialized script args #382 (NATIVE_BRIDGE deprecation note)
• aptos_coin.md — the framework fix below

3. rust-smoke-tests / test_mint_transfer — mint capability read from the wrong address

A prior commit (f23bc892bd) changed delegate_mint_capability / claim_mint_capability / find_delegation to assert @aptos_framework and read MintCapStore / Delegations from @aptos_framework. (That commit is a large 48-file sync; the address change is unrelated to its stated purpose and appears to have been swept in.) Genesis, however, stores both resources under @core_resources (configure_accounts_for_test) and destroys @aptos_framework's MintCapStore during genesis (destroy_mint_cap). On any running chain those reads hit an empty location, so delegate_mint_capability aborted with ENOT_APTOS_FRAMEWORK_ADDRESS. Restored the @core_resources target these functions previously used (they are test/testnet-only by design).

That same commit also added a test_destroy_mint_cap Move unit test (and an init_delegations helper) that set the resources up under @aptos_framework. With the functions reading @core_resources, that test aborted and failed the framework Move unit tests (rust-targeted-unit-tests). Those helpers were introduced by that commit and aren't used elsewhere; removed them to restore the consistent state (the delegate→claim flow is covered by the mint_transfer smoke test).

Verified locally: aptos::mint_transfer::test_mint_transfer passes (1 passed; 0 failed); framework Move unit tests pass (663 passed; 0 failed).

4. rust-smoke-tests / account-abstraction tests — marked #[ignore] (AA unsupported)

test_ethereum_derivable_account / test_solana_derivable_account aborted because the ethereum/solana derivable authenticators are never registered at genesis: initialize_account_abstraction is intentionally gated off for Movement (see #238), which does not currently support account abstraction. Rather than enable an unsupported feature to satisfy these inherited upstream tests, they're marked #[ignore] (nextest skips ignored tests under the smoke-test profile). Re-enable if/when AA is supported.

Known inconsistency (out of scope): ACCOUNT_ABSTRACTION / DERIVABLE_ACCOUNT_ABSTRACTION are still in default_features(), so the on-chain flags advertise AA as enabled even though genesis never initializes it. Reconciling that (removing them from default_features) is a separate on-chain decision.

Still outstanding (not in this PR)

• Container builds (aptos-node, aptos-debugger, aptos-faucet-service) — binaries compile fine; they fail at docker login ghcr.io with denied: denied. The INFRA_GH_PAT secret (user sre-movement) is expired/invalid or lacks write:packages. Fix is a secret rotation in repo settings — no code change makes this pass.

Test plan

• cargo build -p aptos-cargo-cli compiles the merge-base changes
• cargo build -p aptos-cached-packages yields a clean tree after regen
• cargo build -p aptos-vm-genesis compiles the genesis change
• test_mint_transfer passes locally with the framework fix
• framework Move unit tests pass locally (663 passed; 0 failed)
• derivable AA smoke tests marked #[ignore] (AA unsupported); nextest skips them under the smoke-test profile
• CI: rust-check-merge-base, rust-targeted-unit-tests, rust-build-cached-packages, and rust-smoke-tests green