Harden Testnet BENS deployment startup

[JOY (JOY)]

What changed

• make the deployed BENS directory traversable and the generated runtime config readable by the official non-root BENS image user
• detect whether Graph Node actually activates the subgraph after Graph CLI returns
• retry transient Graph admin deployment failures with the already uploaded immutable IPFS hash
• add regression assertions for both production-runtime failure modes

Root cause

Run 31622196197 exposed two independent first-deploy failures. Graph CLI received an ECONNRESET while Graph Node was activating the uploaded subgraph, leaving no active version. The deployment archive was extracted under umask 077, and cp -a preserved a mode-0700 BENS directory, so the official BENS image user could not read config.json.

Validation

• python -m unittest discover -s .github/scripts/tests -p 'test_*.py' - 24 passed
• python scripts/validate-testnet-bens.py
• actionlint.exe .github/workflows/deploy-config.yml .github/workflows/dependency-build.yml
• docker compose ... config -q
• rendered deployer command validated with Alpine /bin/sh -n
• git diff --check
• failed deployment rollback verified healthy locally and through https://test.doscan.io/api/v2/stats

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Code Review

This pull request introduces a retry mechanism for deploying the dos-names subgraph in the testnet environment, including health checks to verify subgraph readiness and extraction of the IPFS hash for retry attempts. It also adds corresponding test coverage. The review feedback suggests improving test robustness by asserting the presence of the delimiter string before splitting the workflow file, and refining the regular expression used to extract the subgraph IPFS hash to avoid capturing intermediate file hashes.