feat(seinode): publish per-node endpoint URLs in status

[bdchatham]

What

Adds SeiNode.status.endpoint (NodeEndpointStatus) so a follower node's in-cluster URLs — evmJsonRpc, evmWs, tendermintRpc, tendermintRest — are discoverable by external orchestration. Populated only for EVM-serving modes (fullNode/archive); validator/replayer leave the field absent.

Why

The migration off SeiNodeDeployment needs an EVM JSON-RPC load target for the nightly chaos harness. That target must be a follower node — genesis validators run ModeValidator, which disables EVM HTTP/WS — but SeiNodeStatus had no endpoint fields, so a standalone follower surfaced nothing to read.

This change makes the controller expose the endpoint; it deliberately does not create load balancers or gate status on a deep health probe. The controller's job is discoverability — readiness probing and load-balancing decisions belong to the consumer (seictl / platform CICD), which picks the strategy that fits its case.

Design

• Status-only, additive. New optional pointer field + type. No spec change, no CRD version bump, backward-compatible.
• No new Service, no RBAC change. URLs are pure derivation from the headless Service the SeiNode reconcile already applies (<name>.<ns>.svc + seiconfig.Port*). Mirrors the existing seinetwork endpoint composition.
• Mode-gated on the spec sub-spec (FullNode/Archive), not noderesource.NodeMode — which collapses replayer -> ModeFull and would wrongly surface endpoints for an ephemeral replayer (regression-guarded in tests).
• Readiness is a consumer concern. .status.endpoint is a discoverability signal, not a serve-readiness guarantee (PhaseRunning is set by a no-op MarkReadyHandler); consumers probe before driving load.

Tests

servesEVM truth table; exact-URL asserts for fullNode/archive; nil for validator/replayer; reconcile-integration (fullNode->Running sets endpoint + Service exposes :8545; validator->nil; idempotent/no-churn across reconciles). All pass; node package 88.7% coverage.

Note: make test exits non-zero in some local toolchain setups due to a gvm go1.26-shim / go1.25.6-pkgset -coverprofile stdlib-recompile mismatch — environmental, not a test failure (every package prints ok; verified clean without -coverprofile).

Provenance

Design + cross-review captured in the migration workspace (LLD WS-A0-controller-lld.md; xreview ledger RESOLVED — kubernetes-specialist + sei-network-specialist + platform-engineer + idiomatic-reviewer). Unblocks the seictl network/node split (WS-A) and the platform nightly migration (WS-C).

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Additive status-only CRD change with no new cluster resources or RBAC; main caveat is consumers treating URLs as ready without probing.

Overview
Adds optional SeiNode.status.endpoint (NodeEndpointStatus) so orchestration can read in-cluster URLs for standalone follower nodes without inventing DNS themselves.

When phase is Running, the node reconciler sets endpoint URLs derived from the existing headless Service (<name>.<namespace>.svc) and seiconfig ports: EVM JSON-RPC/WS plus Tendermint RPC and REST. Full node and archive modes get the full bundle; validator and replayer leave the field absent. Gating uses spec.fullNode / spec.archive, not internal mode enums, so replayers are not mis-advertised as RPC targets.

Endpoints are documented as discoverability only (not listener readiness). The controller does not clear endpoint on brief non-Running phases, to avoid status flapping. CRD/manifests and deepcopy are updated; unit and reconcile tests cover URL shape, mode nil cases, and idempotency.

^{Reviewed by Cursor Bugbot for commit b3e9e06. Bugbot is set up for automated code reviews on this repo. Configure here.}