Structured image builds, images.json, and the dual bidding gateway

[KA-ROM]

Structured image builds, images.json, and the dual bidding gateway

Three changes to the buildernet-node recipe and the image machinery behind
it. The rendered manifests are pinned by a golden test, so the diff there is
the review.

Two bidding gateways, as staging runs them

A production builder ships blocks to two gateways, one collocated on loopback
and one remote. The recipe renders both: gateway-local inside the el-1 pod
and bidding-gateway-1 beside it, with the ports, shared auth token and
health polling taken from the staging inventory
(aws_rbuilder_staging_use2), plus the builder identifiers a gateway checks a
block against before it seals.

An image build is described in fields, not a shell line

ImageBuildSpec now carries dockerfile or assetDockerfile, target,
buildArgs, secrets, assets and the release version behind the pinned
commit. The docker or podman command is derived from those fields, and cmd
stays as an escape hatch for anything they cannot express.

build writes images.json

Next to the manifests, manifests/<recipe>/images.json lists every image the
recipe references, keyed by the tag the manifests use, with the build that
produces it:

"localhost:30500/decker-flowproxy:22aa1d57…-b40f8e0a4a19": {
  "repo": "https://github.com/flashbots/rbuilder-prism",
  "ref": "22aa1d5764076b21f86515f73a48a9978ffb1376",
  "version": "v1.16.0",
  "assetDockerfile": "flowproxy.Dockerfile",
  "secrets": ["gh_token"],
  "cmd": "$ENGINE build --build-context src=. …"
}

The _assets files it names are copied out beside it. That is what lets an
external builder, CI or an in-cluster buildkit, build exactly the tags the
rendered manifests reference without parsing a command string or keeping its
own copy of the pins. ALP now does exactly this, which is how a pin drift bug
class disappears.

One fix that came out of it: the builder and gateway images build from a
private repo with private cargo dependencies, and their specs did not declare
the gh_token secret. Nothing noticed because the images were already built.

The builder container is three files

rbuilder-operator-reth.ts keeps the container; its config template and
production's eight ordering builders move into a companion directory. The
prototype loader only reads files, so a directory beside the module is free.

Tests

20 new deno tests: the derived build command, the images.json payload, the
TOML override rules, the genesis predeploys, the recipe's option surface and
the generic container image override. The k8s render of buildernet-node is
pinned golden, images.json included, so a changed pin has to be an explicit
golden update.