Bind encrypted Zone deposits to sender

[decofe]

Summary

• bind encrypted Zone deposit payloads to the parent-chain portal caller
• require callers to provide the sender when preparing reusable encrypted payloads
• pass the Earn gateway as the sender for viem Earn actions

Motivation

tempoxyz/zones#1028 binds encrypted-deposit HKDF input to the authenticated parent-chain sender. Viem must include that sender so payloads produced by encryptedDeposit and prepareRecipient remain valid.

Dependencies

• Required by tempoxyz/earn#203
• Required by tempoxyz/docs#802
• Required by wevm/wagmi#5222

Validation

• pnpm exec biome check on changed TypeScript files
• pnpm check:types reached repository-wide generated-contract imports; generation was blocked because SSH submodules are unavailable in this sandbox

Prompted by: @0xrusowsky

[vercel]

@decofe is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: 729d59e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
viem	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/viem@4995

commit: 729d59e

[struong]

Closing given #5002