ci: migrate pinner to Filebase and proof-chain stack to Hardhat

[noslav]

Summary

This PR does two things, both gated on upstream changes that the bsp-agent CI was no longer compatible with:

1. Pinner migration — bring bsp-agent in line with ewm-das#72 (Filebase replacement for the retired w3 CLI). The pinner is now FILEBASE_RPC_TOKEN-only, listens on :5080, and drops --w3-agent-key/--w3-delegation-proof-path.
2. Proof-chain stack swap — replace trufflesuite/ganache-cli + ghcr.io/covalenthq/cqt-virtnet:latest (Truffle 5.4.21, last built Jan 2023, broken since solc-bin.ethereum.org started 301-redirecting) with us-docker.pkg.dev/covalent-project/network/cqt-staking:pectra-stable (hardhat fork-from-mainnet). This mirrors the proof-chain stack covalenthq/refiner already uses in CI today.

The two changes ship together because the bsp-agent CI workflow runs both as one stack — neither half is independently testable.

Confirmation — CI is green end-to-end

The agent runs all the way through: it consumes a replica from Redis, encodes it, pins via the new Filebase-backed pinner, submits the proof tx through the hardhat fork, and writes the binary file out locally.

ewm-das       | INFO  generated dag has root cid: bafybei…
bsp-agent     | Proof-chain tx hash: 0xbab629ab…b60199 for block-replica segment: 1-19727343-replica
bsp-agent     | File written successfully to: ./bin/block-ethereum/1-19727343-replica-0xbab629ab…

File-by-file

Pinner migration (Filebase)

• docker-compose-ci.yml, docker-compose-local.yml, docker-compose-hardhat.yml — swap W3_* env + --w3-* pinner flags for FILEBASE_RPC_TOKEN; drop port 3001; fix $PROOF_OUT_HEX shell-escaping. docker-compose-hardhat.yml also moves off the legacy ipfs-pinner image to the unified ewm-das one.
• .github/workflows/docker-image.yml — drop WEB3_JWT, W3_AGENT_KEY, W3_DELEGATION_FILE from the generated .env; add FILEBASE_RPC_TOKEN.
• .envrc (gitignored, local-only) — drop W3_*/WEB3_JWT exports; add FILEBASE_RPC_TOKEN placeholder.

Proof-chain stack swap (Truffle → Hardhat)

• docker-compose-ci.yml —
  • Remove the node (ganache-cli) service and the cqt-virtnet service entirely.
  • Add eth-node (cqt-staking image as hardhat-node, forks from $ERIGON_NODE) and cqt-staking (proof-chain deployer, runs npm run docker:deploy).
  • Repoint the agent's links/depends_on to cqt-staking; flip --proof-chain-address from the ganache-deterministic 0xEa2ff902… to the hardhat-deployed 0xce44d283… (same address refiner uses).
  • Hardcode MB_RPC_URL=http://hardhat-node:8545/. The RPC_URL secret still pointed at ganache-cli, which doesn't exist on the network anymore; sourcing the URL from a stale secret was the cause of the post-swap "dial tcp: lookup ganache-cli" failure mid-PR.
• .github/workflows/docker-image.yml — pass ERIGON_NODE into .env so the hardhat fork has an upstream RPC.

Required CI setup (out of band)

These need to exist as repo secrets on covalenthq/bsp-agent before CI passes:

• FILEBASE_RPC_TOKEN — Filebase IPFS RPC API token, scoped per-bucket (Filebase console → bucket settings).
• ERIGON_NODE — mainnet RPC URL for the hardhat fork. Use the same value refiner has.
• PRIVATE_KEY — set for (BSP operator from cqt-staking's deployContractsAndAddOperators.js, derives to 0x15d34AAf54267DB7D7c367839AAf71A00a2C6A65, which is the whitelisted Block Specimen Producer on the hardhat-deployed BSP proof-chain). Well-known test mnemonic, no real funds.

Retired (can be deleted once this merges): WEB3_JWT, W3_AGENT_KEY, W3_DELEGATION_FILE.

Now unused

• ghcr.io/covalenthq/cqt-virtnet:latest image — no remaining bsp-agent consumer.
• ./ganache_data/ directory still in the repo tree but referenced by no compose file. Worth a follow-up git rm -r.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 15.31%. Comparing base (5e7ea7e) to head (d448432).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/storage/ipfs.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #341   +/-   ##
=======================================
  Coverage   15.31%   15.31%           
=======================================
  Files          52       52           
  Lines        6112     6112           
=======================================
  Hits          936      936           
  Misses       5131     5131           
  Partials       45       45           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rogarcia]

LGTM