[GCdePaula]

Cuts v3.0.0-alpha.6, the release candidate for the staging pipeline and testnet, with one fix found in a last review. Two commits:

1. fix(node): read each key source once, so a piped key works. The early key check from Sling node hardening for the v0.22 generation #299 read the key file and dropped the signer, and signer creation read it again after the chain check. A source that yields its contents once, such as --auth-private-key-file /dev/stdin, was empty the second time and refused as an invalid key (exit 30). SignerSource::prepare now reads every local source once before the network, the KMS key-id file included, and into_wallet builds the wallet from what was read. Validation still happens before any network call. The bug never shipped, so it gets no changelog entry.
2. docs: cut v3.0.0-alpha.6 in the changelog. Titles the Unreleased section with the tag and lists the generation's addresses; removes the cut's to-do item; the audit plan marks the release candidate done.

The addresses are what the deploy scripts produce. They match the deployment-addresses asset that CI built for main (all 18 contracts on both chains), and against v3.0.0-alpha.5's asset exactly five move: the provider, the factory, DaveAppFactory, CartesiStateTransition and Tournament. The rollups contracts keep their addresses.

Validation

• A new unit test feeds anvil's key through a FIFO, removes the FIFO after prepare, and checks the wallet's address.
• The binary: before the fix, a valid key on /dev/stdin exits 30 with "does not hold a valid private key". After it, stdin and a file both pass the signer and stop at the next check.
• just check; the anvil harness (28).

After merge

Tag v3.0.0-alpha.6 on main and create its GitHub pre-release; the tag's CI uploads the node binaries, contract artifacts, deployment addresses and devnet.

[stephenctw]

LGTM!!