feat(seitask): WS-C — rpc scenario templates → SeiNode + provision-node RBAC

[bdchatham]

What

Controller-side half of WS-C (the platform nightly migration):

• runner/rbac.yaml: grant the seitask-runner Role seinodes create (provision-node's first act is c.Create(SeiNode) — without it every rpc-fleet step 403s) + seinodes/status get (forward-compat, matches the existing /status pattern).
• scenarios/{load-test,release-test}/rpc.yaml.tmpl: rewrite from a dead second kind: SeiNetwork (replicas: 2) to a single kind: SeiNode fullNode follower. name/ns/ownerRef/labels/peers are stamped by provision-node at runtime.

Why

Pairs with the platform WS-C PR (chaos workflows → provision-node) and consumes the already-merged provision-node (#419) + SeiNode.status.endpoint (#418). The old rpc.yaml.tmpl rendered a second genesis pool, not followers.

⚠️ Hard merge gate — Q4 live-CRD dry-run

The new kind: SeiNode template has never been applied against the deployed CRD. make build/lint/manifests are clean and strict-unmarshal passes, but that only covers the repo-bundled CRD. Before merge, run server-side validation against the target cluster:

seictl node apply bench-nightly-r1-rpc-0 --preset rpc --chain-id bench-nightly-r1 \
  --image <img> --network bench-nightly-r1 -n <ns> --dry-run

A clean dry-run (no Invalid/unknown-field/missing-required) closes it. Specifically verify the deployed CRD doesn't enforce a peers/CEL constraint on fullNode that the repo CRD doesn't (followers get peers stamped post-render).

Sequence

This PR (+ its seitask image build) lands before the platform PR, which bumps to the resulting image. RBAC should merge first/standalone.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Expands workflow SA permissions to create SeiNode CRs and changes how nightly RPC fleets are modeled; operational risk if deployed CRD validation diverges from repo schema (called out in the PR merge gate).

Overview
RPC scenario templates for load-test and release-test no longer render a second SeiNetwork genesis pool. They now describe a single SeiNode fullNode follower (chainId, image, role-specific overrides); naming, labels, peering, and topology stay provision-node’s job at apply time.

Runner RBAC grants seitask-runner seinodes create (required for provision-node’s initial Create(SeiNode) fan-out) plus seinodes/status get for forward compatibility. Read verbs remain for selector fan-out and post-create waits.

Tests split bundled-template coverage: provisionnode validates both scenarios’ rpc.yaml.tmpl via renderNode; provisionsnd keeps genesis/validator SeiNetwork templates only and drops rpc.yaml.tmpl from its bundled test.

^{Reviewed by Cursor Bugbot for commit 1985129. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c72d84c. Configure here.}