feat(tee)!: bootnode-based devp2p config; --peer→--bootnode, [network]/[node] split

[samlaf]

Part of the reth devp2p gossip project (analysis in SeismicSystems/seismic-reth#426).

Rework the operator/founding CLIs onto reth devp2p bootnodes, matching the tdx-init config schema shipped in
SeismicSystems/enclave#221.

Config wire format (client side of the enclave change):

• --peer → --bootnode (enode://<128-hex>@host:port). reth dials the bootnodes verbatim; tdx-init derives each node's root-key fetch peers from them (http://:7878, own entry dropped), so there is no second peer list that can skew from the bootnode set.
• Sections split by provenance: coordinator-produced [network] (manifest_base64, reth_genesis_base64, bootnodes) and this-node-only [node] (external_ip, genesis_node, [node.domain]). Replaces the old [root_key] + [domain]. external_ip feeds reth's --nat extip so the advertised enode is dialable. build_config fails fast client-side on an empty external_ip or a bootnode-less joiner, mirroring tdx-init's 400s.

Founding-cohort bootstrap (cli/network/bootnodes.py):

• Fetch/normalize/persist enodes via the public seismic_nodeInfo RPC (admin is disabled on these nodes; RPC added in feat(rpc): expose enode on seismic_ namespace for devp2p bootstrap seismic-reth#430). Normalization drops reth's ?discport= and preserves bracketed IPv6.
• Greenfield is two-stage: an enode isn't known until reth is up, so configure genesis first, poll its enode, then bootnode the joiners off it. The founding set is persisted to nodes/bootnodes.json (gitignored runtime state); a later run reuses it and configures the whole cohort in one pass.

Also:

• Remove --no-wait from both seismic-tee-network configure and seismic-tee-node configure: nothing invoked it, and enode collection needs reth up regardless, so it always watches provisioning through to a ready/failed verdict now.
• Persisting the founding set degrades to a warning if enode collection fails, so the cohort report always prints.
• Bump the dev stack VHD to the 2026-07-14 image (carries the new tdx-init).

BREAKING CHANGE: the POSTed tdx-init config drops [root_key]/[domain] for [network]/[node], and seismic-tee-node configure takes --bootnode instead of --peer. Requires a node image with enclave#221's tdx-init; an old CLI POSTing to a new node (or vice versa) is rejected with a 400.