Same-batch official Council handoff capture proof

Description

This is the concrete on-chain proof requested in chat. Batch steps: 1. Deploy an official protocol Council through CouncilDeployer.deployFor. 2. Switch Templ governance to that predicted Council. 3. Relay primary wallet's Permit2 ProposalIntent into the new Council to create the drain proposal. 4. Relay secondary wallet's Permit2 VoteIntent FOR proposal #1. 5. Execute proposal #1 from the new Council. Predicted Council: 0x09b4c5B30ea8470b1711e4763b7cB5d9f565b8E5 Council: 0x54a2c51109C4AABB786aD56616bCFa82015a670b, 0xa104305dBAC043637E7Ae5dEfc63B3f9f9bC0ae1, 0x245e9F95AB591856fe499e66378CCD98B7491953 New Council params: approval=5100, quorum=1000, votingPeriod=259200, executionDelay=86400, immediate=6000. Drain amount: 533.45085 USDC to 0xa104305dBAC043637E7Ae5dEfc63B3f9f9bC0ae1. The exploit is not a custom custody wrapper. It is the same-batch post-pointer-flip governance handoff path: after setGovernance, the newly installed official Council is recognized by Treasury during later actions in the old proposal execution.