Light the Sun. Then the planets.
Nobody holds a key for ORBIT. The Sun's address is computed from its bytecode and its arguments, so the first wallet that sends the transaction puts it on chain for everyone; the first wallet that calls launch() puts $ORBIT on Pons with the Sun as its fee recipient. And every planet is lit by whoever pays its fee — the brief's six, or any other asset on the chain.
One transaction to Arachnid's proxy carrying the salt and the Sun's init code. The result lands at 0x39aa28222F836C1Ba2cC298b316948abDcCeC1d4 whoever sends it. About 3.3M gas.
init code hash 0x5f34dd6616e07e1015638af5ee587317a3716a1f4f6c1e688872bd0cfb829560
launch() puts ORBIT on Pons V2 with the Sun as creator-fee recipient and a 1% creator tax. Name, ticker and description are fixed in the contract; you choose the logo, the website and a first buy (yours, exempt from the launch snipe tax). Cost: Pons' fee of 0.0005 ETH plus the buy.
After both steps the sky reads the chain on its own: the preview chip turns live, planets take their real mass, and entering a planet becomes a transaction.
A planet is an asset the Sun pays in. Anyone lights one for 0.01 ETH; it takes the next orbit out (the k-th planet locks its orbits for (k + 1) × 7 days, at most 91) and is permanent. The token must be a contract with 18 decimals that no planet pays in yet.
What fixes the Sun's address
Every byte of the compiled contract (a recompile after any source change, including the metadata hash), the Pons factory, the Pyth address and the ETH/USD feed. Planets are not part of it: they are storage, added one by one, by anyone, after the fact. Change any of the four and the address changes — never a silent swap of what lives at a known address.