playbook: deploy tysm canary configs from templates

[parithosh]

Split out of #180 per review feedback (it mixed concerns with the backport batch).

What

On glamsterdam-devnet-7 the tysm beacon canary's hook + xatu config files were hand-copied into the prysm datadir — the prysm role has no file-push task (ethpandaops/glamsterdam-devnets@25695b9 notes this) — so every new canary host crash-looped on missing files until someone ran an ad-hoc copy.

This backports the generic mechanism, driven by a dedicated tysm inventory group (empty by default in the template):

• terraform nodes.tf — node entries take an optional tysm = true flag. It propagates as a tysm:<network> tag (DigitalOcean) / label (Hetzner) on the instances, mirroring how supernode and builder_index flow today.
• ansible_inventory.tmpl / outputs.tf — the tag surfaces as a per-host attribute and renders a [tysm] group in the generated inventory. The group header is always emitted so the playbook play resolves; it's just empty until a node opts in.
• firewall.tf — new tysm firewalls (DO + Hetzner) open the 8675 control API port (bad-tysm dials back on it) scoped to tagged instances only, unlike the fleet-wide rule on glamsterdam. Created only when at least one tysm node exists.
• inventories/devnet-0/templates/tysm/*.j2 — hook + xatu configs templatized on existing vars: inventory_hostname (instance/pod/node names), ansible_host (the self_url IP bad-tysm dials back to), ethereum_node_cl/ethereum_node_el (labels), ethereum_network_name (namespace). ${TYSM_TOKEN} placeholders resolve from container env at load, not from Ansible.
• New play in playbook.yaml — targets hosts: tysm (no more tysm_enabled host_vars flag), placed before the ethereum_node role play so the files exist before first container boot. Creates the prysm user/datadir mirroring the role's ownership and renders both files into the datadir, which the existing mount surfaces at /data in the container. Tagged [ethereum, ethereum_node, tysm].

The group is empty in the template, so forks see no behavior change unless a node entry opts in via tysm = true. Live equivalent: ethpandaops/glamsterdam-devnets#58.

Verification

• terraform validate passes and terraform fmt --recursive --check (the CI lint) is clean.
• Rendered ansible_inventory.tmpl via templatefile() with mock hosts (one tysm-tagged, two not): [tysm] contains exactly the tagged host; with no tagged hosts the group renders empty but present.
• ansible-playbook --list-tasks against that rendered inventory: the tysm play targets the tysm group with the three deploy tasks, ordered before the ethereum_node role play, matching under -t ethereum, -t ethereum_node and -t tysm.
• Exact CI lint invocation (ansible-lint --profile production + the workflow skip-list): no new violations. The 4 failures CI reports at the "Refresh inventory web" play are pre-existing on master (#noqa vs # noqa: syntax) and are fixed by backport generic improvements from glamsterdam-devnets and bal-devnets #180 — this PR goes green once that merges.

🤖 Generated with Claude Code