feat(config): require explicit chain config — no silent Mutinynet defaults

[TaprootFreak]

Summary

The chain-shaping env vars (IS_MAINNET, ESPLORA_URL, ESPLORA_WS_URL) used to silently default to Mutinynet endpoints. Two distinct silent footguns:

1. A Mainnet deploy that forgot ESPLORA_URL / ESPLORA_WS_URL would scan Mutinynet while /api/info reported Mainnet, with a green /health/ready and a 5-s HTTP retry loop on the scanner (architecture: no polling, events only (scanner Esplora, repo-wide principle) #84).
2. A Mutinynet deploy that left ESPLORA_WS_URL unset coupled itself to the public wss://mutinynet.com endpoint we do not operate.

This PR makes all three explicit-or-panic on every code path — same contract as USERNAME_DOMAIN, PUBLISHER_KEY, DATABASE_URL. Plus a mechanical guardrail test that prevents the literal URLs from creeping back into the source.

What changes

Code (production):

File	Change
node/src/lib.rs	build_network_config_from_env panics on missing / empty / ambiguous IS_MAINNET, ESPLORA_URL, ESPLORA_WS_URL. IS_MAINNET accepts only the exact strings true / false.
node/src/scanner_ws.rs	DEFAULT_ESPLORA_WS_URL and DEFAULT_ESPLORA_HTTP_URL constants deleted. ScannerWsConfig::from_env → from_network_config(&EsploraConfig) — single source of truth.
node/src/main.rs	Calls the new constructor.
node/src/publisher.rs	EsploraConfig.ws_url doc-comment updated to reflect "always Some(...)" invariant.
node/src/bin/recover_inscription.rs	Same explicit-or-panic for IS_MAINNET.

Guardrail:

node/tests/no_chain_hardcodes.rs — scans every .rs file under node/src/ (excluding *_tests.rs and comment lines) for literal mutinynet.com / mempool.space URLs in any scheme. Fails the build on hit. Prevents a future "harmless refactor" from re-introducing a default.

Tests:

• main_tests.rs rewritten — old defaults_to_mutinynet_when_* tests deleted (their semantics no longer exist); added panic-path coverage for every missing / empty / ambiguous combination on every var; symmetric happy-path Mutinynet case added.
• scanner_ws_tests.rs — from_env smoke replaced with from_network_config smoke + a panic-on-missing-ws_url regression.
• runtime_tests.rs — defensive set_var blocks now also set IS_MAINNET=false and ESPLORA_WS_URL.
• .github/workflows/ci.yaml — both node-tests and coverage env blocks now set IS_MAINNET=false and ESPLORA_WS_URL=ws://127.0.0.1:1/api/v1/ws alongside the existing ESPLORA_URL placeholder.

Docs:

• README.md Configuration table — three vars flip from https://mutinynet.com/api style defaults to (required, no default). New paragraph explains the bias removed and the guardrail backing it.
• CONTRIBUTING.md — same, plus the minimal local-dev env snippet now sets all five required vars explicitly.

Why a separate guardrail test

The literal URL string is exactly the pattern a reviewer cannot easily catch on a one-line diff that "moves a default somewhere sensible". Mechanical enforcement is the only durable fix — otherwise the next person hardening some adjacent piece of code re-introduces the same class of fallback in good faith.

Coordinated follow-up

DEV's deploy compose (DFXServer/server/infrastructure/dfxdev/zkcoins/docker-compose.yaml) currently does not set ESPLORA_WS_URL — it relies on the public Mutinynet default this PR removes. The companion PR on the DFXServer repo adds the explicit env. Merge order: DFXServer PR first (the new env is harmless under the old code), then this PR (the new code requires the env).

Test plan

• CI green on ci:full — lint-and-build, Node + Shared Tests (M3 Ultra), Coverage Gate (100% lines + functions).
• Local pre-push: cargo fmt --all --check ✓, cargo clippy -p node -p shared -- -D warnings ✓, cargo check --workspace --all-features ✓ (already verified before push).
• Verify the new guardrail test compiles and runs (will fire in Node + Shared Tests once ci:full is applied).
• Smoke-check the panic messages by running the node locally without one of the three vars set — should panic with the documented diagnostic, not start.