fix: configure initial certificate roles

[leopoldjoy]

Summary

• accept initial owner and revoker addresses in the CertManager constructor
• reject zero role addresses and emit initialization events for the configured roles
• update deployment docs, changelog, tests, and demo/test deployments

Audit finding

Addresses external finding #18.

Tests

• forge fmt --check src test script
• forge test (205 passed, 1 skipped)
• production CertManager runtime remains within EIP-170