feat(venue): SURPLUS_ATTESTER_ONLY — a quorum member that never issues

[drewstone]

Replaces the op5 SURPLUS_INFERENCE_URL=router bridge (honest but a hack) with a first-class role.

The problem

venue.rs's bonded-issuer invariant treats "has a key + is in a CLOB book" as "is an issuer" and panics if such a node serves inference in router-proxy mode. But an independent-DC quorum member like op5 co-signs batches without ever issuing a lot — the invariant is broader than the role it guards. The live fleet bridged it by pointing SURPLUS_INFERENCE_URL at the Router, which clears the panic but is exactly the reselling the rule means to forbid.

The fix

SURPLUS_ATTESTER_ONLY=1:

• excludes the node from the bonded-issuer check — it issues nothing, so the own-model rule cannot apply; and
• hard-disables issuance — signed_mm_quote returns None and rfq_quote refuses, so the node signs no maker orders and mints no lots.

A node that cannot issue cannot resell, so the invariant's security goal holds by construction rather than by a config pointer.

Proven

A node in router mode, in a book, with no own model + ATTESTER_ONLY=1:

BOOT: ok (no panic — router mode + in-book + ATTESTER_ONLY)
RFQ response: order rejected: this node is attester-only (quorum member) and does not issue quotes
ISSUE-GUARD: ok (refuses to quote/issue)

Pre-fix that exact config panicked on boot. Operator suite still 19/19.

Deploying op5 with this drops the inference.conf drop-in for a one-line SURPLUS_ATTESTER_ONLY=1.

🤖 Generated with Claude Code