chore(platform): re-bump DefaultSidecarImage to actual-latest seictl (sha256:d3ecb1a0...)

[bdchatham]

Summary

Re-bump DefaultSidecarImage from sha256:a6e00256... (PR #199) to sha256:d3ecb1a0... — the actual-latest seictl image built by the Containerize workflow on commit d829dcf (v0.0.48).

What was wrong with PR #199

PR #199 pinned seictl@sha256:a6e00256... after looking at ghcr.io/sei-protocol/seictl:latest. The :latest tag is stale and not maintained by the Containerize workflow:

# .github/workflows/ghcr.yml — Containerize workflow's tag config
tags: |
  type=semver,pattern={{raw}}
  type=ref,event=branch,enable=${{ inputs.ref == '' }}
  type=sha,format=long
  type=raw,value=${{ inputs.ref }},enable=${{ inputs.ref != '' }}

No type=raw,value=latest — the workflow only emits semver, main, sha-<full> tags. :latest was pushed by some other mechanism long ago and never refreshes.

Concrete impact

The :latest digest predates two critical changes that were already on main when we picked it:

Missing in :latest (a6e00256)	Present in :main (d3ecb1a0)	What broke
/v0/livez handler (commit a595641, Apr 3 2026, in v0.0.31+)	✓ registered	Kubelet's livenessProbe got 404 → killed sei-sidecar in restart loop
sei-config v0.0.13 [receipt-store] override (seictl PR #143)	go.mod has v0.0.13	Rendered app.toml lacks [receipt-store] → seid prunes archive's historical receipts

Verified live in pod

GET /v0/healthz → 503 Service Unavailable  (handler exists, returns 503 because mark-ready hasn't fired)
GET /v0/livez   → 404 Not Found            (handler MISSING — confirms a6e00256 predates a595641)
GET /v0/status  → 200 OK                   (handler exists)

How to find this image in the future

Use seictl:main (always head of main branch) or seictl:sha-<full-sha> for a specific build. The Containerize workflow runs on every push to main, so :main tracks main exactly.

docker buildx imagetools inspect ghcr.io/sei-protocol/seictl:main --format '{{.Manifest.Digest}}'
# returns sha256:d3ecb1a0...

Out of scope

• Adding latest to the Containerize workflow's tag list (separate PR in seictl repo if we want :latest to be meaningful again)
• Fixing the seictl publishing such that :latest always tracks main (separate concern in seictl repo)

Test plan

• go test ./internal/platform/... ./internal/noderesource/... passes
• After merge + controller image rebuild + bump in platform: kubectl exec into a fresh SeiNode pod's sei-sidecar shows the new image; curl http://127.0.0.1:7777/v0/livez returns 200 (or appropriate health status, not 404)

🤖 Generated with Claude Code