feat(tempo): add burnAt token role

[decofe]

Adds the TIP-1006 burnAt role to TokenRole. The role maps to BURN_AT_ROLE and activates in T12 (tempoxyz/tempo#7935).

Holders of BURN_AT_ROLE can burn from any unprotected account without a transfer-policy check. Once this role is part of the TokenRole union, viem's token.grantRoles, hasRole and related actions can accept 'burnAt'.

Also fixes the core test job for pull requests from forks. GitHub doesn't pass repository secrets to fork PRs, so VITE_ANVIL_FORK_URL arrives as an empty string. getEnv treated that as set, so anvil started without a usable fork URL and the AbiEvent behavior: network tests failed with an HTTP 400. getEnv now treats an empty value as unset and falls back to the public RPC.

Validation: pnpm test --project tempo-unit src/tempo/TokenRole.test.ts, vp check, and pnpm check:types all pass.

Prompted by: @max-digi

[vercel]

@max-digi is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/ox@497

commit: cd0ec2d