feat(test): TestRelease + general keygen — run the release harness via the SDK (WS-I)

[bdchatham]

What

Final WS-I suite: ports the release-validation scenario to a Go-native TestRelease, and refactors keygen out of seitask into a general package.

• internal/keygen (new, k8s-free): the BIP-39 → cosmos-secp256k1 → bech32 derivation, Derive() Identity. internal/seitask/keygen keeps only the Secret/workflow-vars writer over it (the part the cutover deletes). Pre-empts the cutover-lift; hd.go/hd_test.go moved verbatim.
• TestRelease: derive a funded admin → provision 4 validators + 1 EVM-serving RPC (kv index, memiavl, legacy sei_* APIs) → mnemonic Secret → run the external release-test image as a Job → gate on exit code + chain liveness.
• SDK: Node.REST(), sei.WaitRESTServing, TaskSpec.Labels (all additive).

Review

Full Coral slate (sei-network dissenter + systems + k8s + idiom), blinded. The dissenter caught a false-pass — the scenario's env is envFrom workflow-vars CM ∪ explicit list, and the CM carries RPC_EVM_RPC_LIST with no explicit equivalent, so a harness sub-case could skip silently and still exit 0. Fixed (Job env reproduces the CM superset). Plus: WaitRESTServing (LCD cold-start), verdict observability (log the harness pass-count), Job resources/ttl, maps.Clone the package-global config, waitJob ctx-branch pod-log tail.

Empirical answers from review+smoke: fullNode serves REST by default (ModeFull → REST.Enable=true; validators don't — explains the upgrade suite's api.rest.enable); nightly is unenforced-PSS and the scenario sets no securityContext, so none is imposed on the harness image.

Ledger: test/integration/.xreview/release-suite.md

Test

go build/vet -tags integration + golangci-lint — 0 issues. keygen refactor verified behavior-preserving (pure extraction). Smoke-proven live on harbor with the real release-test image (c28ce94): --- PASS: TestRelease (2313s), external harness 749 passing / 0 failed / exitCode 0, clean self-teardown.

With this, all four suites (load, chaos, upgrade, release) run through the harness + SDK.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches mnemonic derivation and Secret wiring for CI release runs; integration Job env and long-running cluster provisioning increase blast radius if misconfigured, but behavior is largely additive with smoke validation.

Overview
Adds TestRelease, a Go integration suite that replaces the Chaos-Mesh release-validation workflow: derive a genesis-funded admin, provision 4 validators + one EVM RPC follower via the SDK, inject the mnemonic through a Secret, run the external release-test image as a Job, and assert exit code plus post-run chain liveness. The Job env mirrors the old workflow-vars superset (including RPC_EVM_RPC_LIST) to avoid silent skip-but-pass; success also logs harness pod output.

Extracts internal/keygen (k8s-free Derive() + shared SecretMnemonicKey); internal/seitask/keygen now only writes Secrets/workflow-vars on top of it.

SDK additions: Node.REST(), k8s handle wiring, and sei.WaitRESTServing so REST is probed before the harness starts (LCD cold-start). waitJob tails pod logs on ctx timeout; releaseBaseConfig is cloned before network create.

^{Reviewed by Cursor Bugbot for commit 169de22. Bugbot is set up for automated code reviews on this repo. Configure here.}