buildernet-node: production-shaped BuilderNet node recipe + genesis predeploys

[KA-ROM]

What

A decker recipe, buildernet-node, that stands up one BuilderNet node the way production runs it, on a local L1 devnet:

users → haproxy → flowproxy → rbuilder-operator-reth (reth + rbuilder, one process)
                                    └→ bidding gateway → mev-boost relay → lighthouse (beacon + validator)

The existing rbuilder recipe only covers the builder-to-relay half (out-of-process rbuilder, no flowproxy, no haproxy). This recipe adds the missing pieces as new containers and pins every component to what flashbots-images trunk/buildernet ships today (rbuilder-prism v1.16.0 for operator-reth, gateway and flowproxy; lighthouse v8.2.0), with configs copied from the production templates.

Why

So a change to rbuilder, flowproxy or gateway config can be tried on a laptop or a kind cluster (ALP dev envs) before it goes into a TEE image.

What's in the PR

• New containers rbuilder-operator-reth, bidding-gateway, flowproxy, haproxy; new recipe buildernet-node.
• flowproxy is built from rbuilder-prism (crates/flowproxy, where it moved on 2026-09-08) at the same ref as the operator, with two small local patches under _assets/: an arch-agnostic Dockerfile and a --chain-id flag. Both are proposed upstream (rbuilder-prism #311, #312); the patches go away once a release has them.
• mev-boost-relay and its housekeeper are pinned to a commit via config.ref; the container default main is a mutable image tag.
• Recipe options, for deviating from production on purpose:
  • rbuilder.<key>=<value> changes one line of rbuilder's config, e.g. rbuilder.evm_caching_enable=false
  • withdrawals=none gives validators no withdrawal credentials, so no per-block withdrawal sweeps
  • triePadding=<n> pre-creates n accounts before any load, for a mainnet-like state trie
• Small plumbing: ImageBuildSpec.name / .variant (one repo can yield several images; a patched build gets its own tag), ensureClone accepts tags and commit SHAs, lighthouse accepts config.feeRecipient.
• Build: make compile now bundles _assets/ into the binary (the flowproxy image tag hashes those files, read relative to the module, lazily). No CI workflow changes.

The genesis fix (second commit)

The gateway pays the proposer through a contract that exists on mainnet, the PaymentForwarder, and when it seals a block it assumes that contract is there. Our devnet genesis did not have it, so the payout call did nothing useful and reth rejected every block the builder won with mismatched block state root.

The recipe now predeploys that contract (plus the four Prague system contracts, also present on mainnet) through the genesisAccounts mechanism from #7. rbuilder-prism's own e2e is disabled for exactly this reason: "until builder-playground ships the PaymentForwarder in its L1 genesis".

Verified

• Renders (build --pods k8s) and generates artifacts; CL and EL agree on the genesis block. Also from a compiled binary in an empty directory.
• On ALP's kind cluster: builder blocks land (extra_data = "BuilderNet devnet"), 60–120 txs per block, no rejections over 1500+ sealed bids.

Not covered

TDX / attested TLS, Builder Hub config, ClickHouse, nftables, edge TLS. It is a dev env, not a TEE image.

Stacked on #13.