fix: enable the published op-geth WebSocket endpoint

[Kewe63]

Summary

Fixes #62.

Compose publishes ${PORT__OP_GETH_WS:-9994}:8546, but the op-geth entrypoint never enables the WebSocket server. The configured op-geth v1.101503.4 binary defaults to --ws=false, so HTTP works while the published WebSocket port has no listener.

• Enable WebSocket RPC on container port 8546 and bind it to the container's network interface.
• Retain the client's default WebSocket API and origin policies; do not add wildcard origins or extra API namespaces.
• Document the host endpoint and distinguish plain ws:// from TLS wss://.
• Add offline regression tests executing the unchanged entrypoint with an argv-recording geth stub in a disposable Linux chroot/network namespace.

Verification

• python3 -m unittest discover -s tests -v: all three tests failed against the original entrypoint; all three pass with this change (none skipped on the test host).
• Tests cover full/archive modes, preserved HTTP/P2P settings, and trailing explicit arguments.
• sh -n scripts/start-op-geth.sh and git diff --cached --check: passed.
• Independently ran the real image binary, Geth 1.101503.4-stable, with the actual entrypoint in an isolated network namespace and temporary datadir. Before the change, 8545/8551 listened but 8546 did not. After the change, 8546 listened and a loopback WebSocket handshake returned HTTP/1.1 101 Switching Protocols. An explicit trailing --ws=false control disabled 8546 again.
• Resolved linux/amd64 image manifest: sha256:618d925cfdbe9310e971dc07e30f655f4da7ac0c1e83bb7dd4f906452dc6e030.

Scope and limitations

No live RPC, peer, snapshot service, or existing node data was used. Docker Compose end-to-end startup/port forwarding was not run because Docker was unavailable in the WSL test environment. The committed tests validate wrapper arguments, not binary semantics; the real-binary check above was a separate local verification. Tests skip explicitly if Linux user/network namespaces or required tools are unavailable.

This activates the already-published WS endpoint. Existing Compose host binding, port overrides, HTTP/auth RPC settings, and data handling remain unchanged. Operators should apply their existing network-access controls; this change does not add authentication or TLS.

PRs #88 and #90 also touch RPC host bindings but do not enable the missing WS listener. This change is limited to #62, not those broader changes.

Implementation and test preparation were AI-assisted.

[kutluhaneth46]

Review

Checked this against current main.

Compose already publishes ${PORT__OP_GETH_WS:-9994}:8546, but scripts/start-op-geth.sh only enables HTTP (--http.addr=0.0.0.0 --http.port=8545) and never turns on the WebSocket server. With op-geth defaulting to --ws=false, host port 9994 has nothing listening — that matches #62.

The three new flags line up with the published mapping:

--ws
--ws.addr=0.0.0.0
--ws.port=8546

Good calls on scope:

• Keep default WS API / origin policy instead of copying HTTP's * CORS/vhosts into WebSocket.
• Document plain ws:// vs TLS wss:// so operators do not assume TLS on 9994.
• Stay out of the broader RPC-hardening work in #88 / #90; this PR only closes the missing listener for #62.

The offline argv tests are a solid regression net for the wrapper. I did not re-run the real-binary handshake locally; the write-up of that check is clear.

LGTM for #62.