test(cketh): adversarial end-to-end coverage of sweeper fee funding

[mbjorkqvist]

Part of DEFI-2933 (sweeper fee funding), last of a seven-PR stack. Targets #11094.

Why

The stack's existing live test proves funding works. This one proves it fails safe. Each test drives a distinct way funding can go wrong through the real pipeline — real ckETH ledger, real EVM RPC canister, local anvil, threshold-ECDSA signature — and asserts the invariant the feature exists to protect: ETH never moves ahead of the ckETH burned to pay for it.

What

Three adversarial scenarios:

• An empty fee account. The burn fails, so no ETH may move. Held for longer than a withdrawal-timer tick, since "the minter must not do this" can only be established as a bounded negative.
• A sweeper already above the low-water mark. No funding is due, so nothing is burned. Also a bounded negative.
• A funding transaction that fails on chain. The destination is given code, so a bare transfer runs out of gas and reverts. The ckETH stays burned and is not reimbursed — it becomes prepaid gas the next funding offsets against, which is exactly what keeps burned ahead of spent. The test waits for finalization and asserts the withdrawal reaches a terminal failed status rather than a reimbursement.

No live fee-spike test: that ceiling is pinned exactly by unit tests, and reproducing it here would mean driving anvil's base fee up over several ticks for little extra signal.

What it found

Waiting for finalization — rather than asserting mid-flight, as the earlier live test did — surfaced a production defect that would trap the withdrawal timer permanently. The fix ships in #11086, where it belongs; this PR is what made it visible.

Harness work this required

Two things had to change before these tests could run at all, both also in #11086:

• A real deposit. Crediting the minter's address with anvil_setBalance moves ETH the minter's accounting has never seen. The harness now emits a genuine ReceivedEth log for the minter to scrape, so its ETH balance counter is backed the way it is in production.
• A PocketIC server that outlives the suite. PocketIc::new hard-codes a 600-second hard TTL, after which the server exits unconditionally — mid-request, ignoring in-flight work, with the budget shared across the whole test binary. Any suite past ten minutes has its backend shot out from under it, and every client then panics with Connection reset by peer. The harness starts its own server with a TTL above the Bazel timeout.

Note on CI: the new target is tagged long_test, so ordinary CI skips it. It needs a run with CI_ALL_BAZEL_TARGETS before merge.

Stack

Merge in order; each PR targets the one above it.

#	PR	Status
1	#11060 — Read a native ETH balance via the EVM RPC canister	ready for review
2	#11065 — Burn ckETH from the minter's own fee subaccount	ready for review
3	#11072 — Add the SweeperFunding withdrawal-request variant	ready for review
4	#11083 — Burn-first accounting for sweeper fee funding	ready for review
5	#11086 — Sweeper fee-funding task, with an end-to-end test	Copilot re-review pending, CI green incl. long tests
6	#11094 — Sweeper funding observability and the prepaid-gas gate	open
7	Adversarial end-to-end coverage of sweeper fee funding	this PR