feat(scenarios/major-upgrade): in-workflow SND provisioning + upload-report

[bdchatham]

Summary

Move SND lifecycle out of the platform-side bash orchestrator and into the Chaos Mesh Workflow itself, matching the release-test/load-test pattern that #326 and #343 established.

• New scenarios/major-upgrade/validator.yaml.tmpl — 4-validator SND with the gov voting-period override + tx_index/api.rest config previously injected via seictl --override.
• Prepend provision-validator-chain (seitask provision-snd --role=validator) as the first Serial child of the entry template.
• Append upload-report (seitask upload-report) as the last Serial child.
• Swap hardcoded ${SEI_DEPLOYMENT}-internal.${SEI_NAMESPACE}.svc.cluster.local:{26657,1317} URLs to ${VALIDATOR_TM_RPC} / ${VALIDATOR_REST} from workflow-vars (seeded by provision-snd's RoleScoped publishing).
• Align workflow-vars CM name to workflow-vars-major-upgrade-${RUN_ID} matching taskruntime.WorkflowVarsName.
• Shrink compute-target-height and resolve-proposal-id from kubectl create --dry-run | apply (CM creation + Workflow UID lookup) to kubectl patch --type=merge (CM is already created with ownerRef by provision-snd).

Per-run resources (SND, workflow-vars CM, SeiNodeTasks) now carry ownerRef to the parent Workflow CR; the platform wrapper's only cleanup duty becomes kubectl delete workflow.

Paired with sei-protocol/platform#634 which switches the harbor cronjob to the slim wrapper. Gated on this PR landing + the matching ECR seitask-runner build.

Test plan

• kubectl-apply the rendered Workflow on harbor manually post-merge + image build; observe terminal phase
• Verify ownerRef cascade: deleting the Workflow CR removes the SND + workflow-vars CM
• Confirm upload-report writes the per-step snapshot to S3

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Moderate risk because it changes the major-upgrade workflow’s orchestration (in-workflow provisioning, variable wiring, and timeouts) and adds S3 report uploading, which could affect CI reliability and cleanup semantics.

Overview
The major-upgrade Chaos Mesh workflow now provisions its own 4-validator SeiNodeDeployment inside the workflow (new validator.yaml.tmpl) and switches node references from an external $SEI_DEPLOYMENT to the in-workflow $SEI_CHAIN_ID deployment.

Workflow variable handling is updated to rely on a pre-seeded workflow-vars-major-upgrade-$SEI_WORKFLOW_RUN_ID ConfigMap (patched via kubectl patch), and RPC/REST access is taken from VALIDATOR_TM_RPC/VALIDATOR_REST rather than hardcoded service URLs. The workflow deadline is extended, an upload-report step is appended to push run artifacts to S3, and the seitask Docker image now includes the major-upgrade scenario assets.

^{Reviewed by Cursor Bugbot for commit 08c6fb1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7978b7f. Configure here.}