backport generic improvements from glamsterdam-devnets (round 2)

[barnabasbusa]

Follow-up to #180 — backports the generic improvements glamsterdam-devnets accumulated since, leaving out everything devnet-specific (gloas fork config, 300M gas limits, image pins, tysm — the latter is already in flight on parithosh/tysm-config-deploy).

scripts/run.zsh

• slash command: triggers the assertoor validator-slashing-single playbook, with JWT minting via the devnet auth provider behind Cloudflare Access (CF_ACCESS_CLIENT_ID/SECRET or ASSERTOOR_TOKEN), token caching, and auto-registration of the playbook.
• consolidate command (EIP-7251): targeted and self-consolidation (0x01→0x02), with full eligibility checks (creds type, status, SHARD_COMMITTEE_PERIOD, shared withdrawal address), dynamic fee handling, and CONSOLIDATION_PRIVATE_KEY support for non-mnemonic withdrawal addresses.
• topup rewritten from serial ethereal (which ignores --nonce online) to parallel cast send with locally computed deposit_data_roots.
• deposit/topup/consolidate submit in batches of 500 (zsh job-table cap) and verify every tx receipt with a ✓/✗ summary instead of assuming success.
• sync_mapping: new pending mode pre-maps the still-queued pending_deposits in one shot after verifying the FIFO queue is strictly sequential for the mnemonic; also refreshes the bootnode inventory-web, rolls dora, and commits the updated mapping.
• expand_validator_indices helper (1..10 ranges), python → python3, alphabetized help.
• send_funds is kept (glamsterdam dropped it; removing template features felt like a separate decision).

ansible

• reshuffle_validators.yaml: safe reassignment of validator key ranges after editing validator_start/end — stop VC → wipe keys → 2-epoch play-wide barrier → sync → start, with an unreachable-host abort so a donor can never keep keys a recipient loads. Uses validator_keys_reshuffle from feat(validator_keys): reshuffle deployed keys when inventory ranges change ansible-collection-general#562 (merged).
• validator_keys_container_name: beacon for teku/nimbus/grandine — they run validators in-process, so reshuffles must restart the beacon container.
• eth_inventory_web_segments_json: hosts can set validator_display_name to control the name shown in validator-ranges.json (dora/assertoor/beacon-metrics-gazer) without affecting key generation.
• Engine snooper → xatu wiring (SNOOPER_XATU_* + jwt volume) so engine-API events land in xatu.
• besu: --color-enabled=false, --cache-last-blocks=2048, --rpc-http-max-active-connections=1000 (log noise + RPC capacity under erpc/dora load).
• xatu sentry: subscribe to data_column_sidecar, enable beaconCommittees + proposerDuty.

ci

• syncoor: add nimbusel + ethrex to the client matrix/defaults, document the DigitalOcean runner labels alongside Hetzner.

Linted with ansible-lint 24.6.0 --profile production: no new findings vs master on the touched files.

[redpandabot]

Summary

Backports generic devnet tooling from glamsterdam-devnets: added slash (assertoor slashing with JWT minting), consolidate (EIP-7251), a parallel cast send topup with locally-computed deposit_data_roots, a pending mode for sync_mapping, an ansible reshuffle_validators.yaml play, teku/nimbus/grandine validator_keys_container_name: beacon, engine-snooper→xatu wiring, and CI matrix additions. I traced the new run.zsh logic in detail (verified the topup deposit_data_root matches the canonical deposit contract's reconstruction, the pending-FIFO jq logic, the consolidate eligibility/fee flow, and the reshuffle barrier) and found the code largely sound; the one concrete gap is an unchecked exit code on the auto git push in sync_mapping.

Issues

• 🟢 scripts/run.zsh:444 — sync_mapping: unchecked git push exit code can silently diverge origin — if git commit -m ... -- "$mapping_file"; then git push origin HEAD:master; else ... exit 1; fi checks the commit exit code but not the push one — on a stale fork (non-fast-forward), transient network error, or wrong branch name, the push fails while the case falls through to exit 0 and prints the success message. The mapping is then committed locally but never reaches origin, and the next run computes next_state from the already-appended local file and exits "up to date" without retrying the push, so the divergence is silent and permanent until manually fixed. Check the push's exit status and surface it like the commit failure.

---

_{Reviewed @ 483dbca3
"The best code is no code at all." — Jeff Atwood}