qa: add retransmit metro test to qa.testnet

[martinsander00]

Summary of Changes

• This PR reworks the TestQA_MulticastSettlement.
• Deleted e2e/qa_shred_settlement_test.go. since it only contained one setup method that I moved into the TestQA_MulticastSettlement file.
• It checks the env we are in, if mainnet, continue as normal, if testnet and program config retransmit flag off, continue as normal too. If testnet and program config retransmit flag on do the following:

1. Assert that when trying to buy a seat in a metro other than frankfurt fails
2. Try to buy a seat in frankfurt and assert that the user accesspass has access to these multicast groups: edge-solana-retrans

• The PR deletes e2e/qa_retransmit_only_settlement_test.go. TestQA_RetransmitOnlySettlement drove the same positive path, so the reworked test covers it now. Its device selector, its metro-code formatter and its group assertion moved into the multicast test file.
• The group codes now come from one flag, -retransmit-group-codes, which replaces -leader-group-code and -retransmit-group-code. The check requires the seat's groups to equal that list, so any extra group fails it.
• sdk/shreds/go/state.go gains IsRetransmitOnlyOnboardingEnforced, which reads bit 7 of the program config flags.
• e2e/internal/qa/client_settlement.go gains that same read, plus ClosestNonRetransmitOnlyDevice for the device the rejection step pays on.
• A companion change in malbeclabs/infra passes -retransmit-group-codes=edge-solana-retrans in qa.testnet.yml and deletes qa.retransmits.testnet.yml. Merge both together, or the hourly job runs the group check without the codes it needs.

[nikw9944]

One finding beyond what's already in review.

The "and nothing else" subscriber assertion compares against User.Subscribers, which is the user account's complete multicast subscription list — not the groups the shred feed seat granted. Any unrelated group the QA client holds trips it, which is exactly the rocksteady / rebop-eu failure in the PR description. The deleted test had this right: retransmit group present, leader group absent.

[nikw9944]

Re-reviewed at b32b8151. The user-type half of the previous finding is verified fixed — GetMulticastServiceabilityUser filters on UserTypeMulticast, so an IBRL user at the same client IP can no longer be read. The other reviewer's findings are all addressed in cb3ec334: the rejection payment moved after wait_for_open_phase, the harness is inlined with the flag read hoisted out of every subtest, the selectors share one predicate, TestProgramConfigFlags passes (its 0x7c case discriminates bit 7), and the CHANGELOG prefix is fixed.

Two things left, neither blocking:

1. The exact-set subscriber assertion is unchanged. The rationale for keeping it is reasonable and it is your call, but it rests on config outside this repo and a live-network observation, so it stands as unverified here. Failures should name group codes rather than raw pubkeys, since the strict form will fire again on any oracle lag.
2. --retransmit-price defaults to 0, which asserts nothing — the old flag defaulted to 10. Until the paired infra change passes it, the enforced path goes green with the discounted price unchecked, silently.

[elitegreg]

Approving. The review feedback is addressed: the rejection step now runs after wait_for_open_phase, the flag is read outside every subtest, the selector dedup and the flag-bit table test are in, and GetMulticastServiceabilityUser fixes the multi-tunnel user ambiguity. go vet -tags qa ./e2e/... and the sdk/shreds/go tests are clean.

Two follow-ups filed rather than held against this PR:

• #4157 — the retransmit-only price and group assertions are gated on the ProgramConfig enforcement bit, but they only depend on a metro being flagged in MetroHistory, so an environment with flagged metros and enforcement off gets no coverage.
• #4158 — the stale oracle snapshot you traced the rebop-eu extra to sounds like a product bug worth confirming.

Remember this needs the malbeclabs/infra change landing alongside it: -leader-group-code / -retransmit-group-code are gone and an undefined flag fails the whole test binary.

[nikw9944]

Both findings from the last round are verified fixed in 72e5802b.

Failures now name groups by code: MulticastGroupCodes reads the program data once and the label closure is applied to both the extras and the subscribed list, falling back to the pubkey for an unknown group. That single read also replaces the per-code lookups, each of which refetched the whole program data. And the enforced path logs at Info with the observed price when --retransmit-price is unset, so a run can no longer look like it checked the price. Keeping the default at 0 rather than 10 is the right call given Frankfurt costs 36.

One note carried forward, no action needed: the exact-set assertion still rests on config outside this repo, so it stays unverified here rather than disputed.