feat(nodetask): ConfigPatch kind + CON-368 executor-mixed nightly test

[bdchatham]

What

Two things, one dependent on the other:

1. ConfigPatch SeiNodeTask kind — a standalone, operator-facing day-2 config patch. SDK surface is just ConfigPatch{Overrides map[string]string}; internally it always maps to a config-apply incremental task, so sei-config's own resolver (ResolveIncrementalIntent → registry-aware ApplyOverrides → legacy render) produces the on-disk config. Correct-by-construction for every registered key — no hand-maintained dotted→file render table. A fail-closed allowlist (giga_executor.*, chain.occ_enabled, mempool.*) is enforced purely as safety policy at three points (CRD CEL family gate, controller, SDK client-check); it excludes keys the controller re-asserts on its own plans (persistent_peers, external-address, genesis/state-sync-managed).

2. TestNightlyGigaExecutorMixed — the CON-368 regression gate. Provisions 4 giga-executor validators (shipped default) + one RPC follower flipped to the v2 executor via ConfigPatch + a standard StateSync re-bootstrap, runs the external release-test suite against it, and asserts the follower stays caught up and advancing throughout.

Why

A v2-executor node must stay in consensus with a giga-executor validator set. A regression that reintroduced the CON-368 executor divergence would make the v2 follower compute a different result than the validators committed, halt it at the diverging block, and fail the post-suite advance assertion. Storage layout is deliberately out of scope (all nodes run the shipped default) so the executor is the only variable under test.

One-way door (CRD API)

New served v1alpha1 surface, additive: enum value ConfigPatch, union field spec.configPatch, payload spec.configPatch.overrides (map[string]string, MinProperties=1). Retained-not-removed thereafter. The allowlist is a value contract worth a look.

Verification

go build ./... + -tags integration, go vet -tags integration, unit tests (SDK / internal/task / nodetask envtest CEL), gofmt, and golangci-lint --new-from-rev=origin/main (how CI gates) — all clean, 0 new issues. The integration test requires a live cluster (nightly harness); it is not run in unit CI.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Additive v1alpha1 API with a hand-maintained three-way allowlist that must stay in sync; runtime node config changes need composed restart/re-bootstrap. Large new nightly integration test depends on live cluster and external release image.

Overview
Adds ConfigPatch as a new SeiNodeTask kind for day-2, allowlisted dotted sei-config overrides written on disk via the sidecar config-apply incremental path (not the StateSync file-tree ConfigPatch task). Admission uses updated union/CEL rules; overrides are limited to chain.occ_enabled, giga_executor.*, and mempool.*, with the same policy re-checked in the controller param builder and SDK.

Wires the kind through nodetask (2m default timeout), internal/task → seiconfig.ConfigIntent, SDK TaskConfigPatch + K8s render, CRD/manifests/deepcopy, and parity tests for the three-way allowlist contract.

Adds TestNightlyGigaExecutorMixed: four giga-executor validators, one RPC follower flipped with ConfigPatch + StateSync re-bootstrap, release-test suite, on-disk v2 verification, and post-suite caught-up/advancing checks with stall attribution. Promotes BurntSushi/toml for integration config reads.

^{Reviewed by Cursor Bugbot for commit 6518a7f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 089a4df. Configure here.}