feat(giga): bump sei-config to v0.0.23 + refuse non-RPC workflow targets

[bdchatham]

Two coupled giga-safety changes for the controller.

1. Bump sei-config v0.0.22 → v0.0.23 (3625cf7)

The controller validates the config-apply ConfigIntent (including spec.overrides) against its own sei-config before dispatching to the sidecar. Empirically confirmed on harbor: a node carrying overrides: {storage.state_store.evm_ss_split: "true"} stalls forever at config-apply with invalid intent: unknown config field "storage.state_store.evm_ss_split" — because the controller was still on v0.0.22. So the controller must be bumped in lockstep with the sidecar (seictl v0.0.67); a sidecar-only bump is insufficient. This unblocks the giga SS-store split for RPC nodes end to end.

2. Refuse non-full/RPC workflow targets (e56d6e3)

Generalizes the prior validator-only refusal into an allowlist: a state-sync / giga-migration workflow may target only spec.fullNode (the RPC role). Validators and archive nodes block-sync (never restore from a snapshot); a replayer is an ephemeral restore workload a wipe-and-resync would destroy. Enforced at both the adoption gate and the planner's belt-and-braces Validate (kept in lockstep — the plan-rebuild recovery path skips the adoption gate). Fails closed for a future node mode. Reviewed GO by kubernetes-specialist + idiomatic-reviewer + prose-steward.

Tests: validator/archive/replayer refusal at both layers; full suite (19 pkgs) green with v0.0.23.

Follow-ups (tracked, not in this PR)

• Replayer shares ModeFull so its config still renders the split — confirm with owner whether that's intended or force it off in replay.go.
• sei-config validate.go: reject evm_ss_split on non-full modes (blocks an explicit override on an archive node).
• Ensure full-node seid images are giga-capable when they receive the default.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches destructive workflow adoption and config validation for giga migrations; mis-targeting or schema drift could block or wrongly permit wipe-and-resync, but behavior is fail-closed with expanded tests.

Overview
Bumps github.com/sei-protocol/sei-config to v0.0.23 so controller-side validation of config-apply intents (including giga fields like evm_ss_split) matches the sidecar schema and config-apply no longer rejects known overrides.

State-sync / giga-migration workflows now allowlist targets to spec.fullNode (full/RPC) only, replacing the prior validator-only check. ineligibleWorkflowRole refuses validator, archive, replayer, and unknown modes at adoption with terminal TargetRejected; the state-sync planner Validate uses the same rule (FullNode == nil) for plan rebuild paths. Docs for ReasonWorkflowTargetRejected and tests cover archive and replayer at both layers.

^{Reviewed by Cursor Bugbot for commit 3625cf7. Bugbot is set up for automated code reviews on this repo. Configure here.}