feat(exit-certificate-claimer): prepare exit_certificate_claimer for deployment

[joanestebanr]

🔄 Changes Summary

Packaging and deployment preparation for the exit_certificate_claimer service.

• 🐳 Dockerfile: ship the exit_certificate (generator) and
  exit_certificate_claimer (HTTP service) binaries in the aggkit image under
  /usr/local/bin, so the tools travel alongside aggkit and the same image can
  be used to deploy the exit_certificate_claimer.

• 📦 docker-compose: add tools/exit_certificate_claimer/docker/docker-compose.yml
  to run the exit_certificate_claimer as a read-only HTTP service. It builds from
  the repo-root Dockerfile, overrides the entrypoint with the
  exit_certificate_claimer binary, and derives its whole config from the
  exit_certificate parameters.toml via --exit-certificate-config. Mounts the
  exit_certificate working dir at /data (read-write, since L1 sync keeps its
  SQLite DBs updated) and wires host.docker.internal so a host-pointing
  l1RpcUrl is reachable on Linux. Defines a healthcheck: and documents the
  volume-permission expectations (the container runs as appuser, uid 1000).

• 🩺 healthcheck subcommand: exit_certificate_claimer healthcheck probes
  GET /claimer/v1/health of a running claimer and exits 0 (healthy) or 1.
  The production image ships without a shell or curl, so the binary itself
  performs the HTTP probe; the docker-compose healthcheck is backed by it.

• 🧪 e2e docker mode: 60-claim_exit_certificate_funds.sh gains
  CLAIMER_MODE=docker to run the claimer through the docker-compose deployment
  instead of a host binary (a sibling config copy rewrites 127.0.0.1/localhost
  to host.docker.internal so the container reaches the Kurtosis-published L1
  RPC). The CI workflow sets it, so the e2e exercises the same artifact users
  deploy — image build from the repo-root Dockerfile included — and now also
  triggers on tools/exit_certificate_claimer/** and Dockerfile changes. The
  compose service user is parameterizable (CLAIMER_USER, default appuser) so
  L1 sync can write its SQLite DBs whatever the host uid.

• ⚙️ .env.example: documented env vars (EXIT_TOOL_DIR, EXIT_CERT_CONFIG,
  CLAIMER_ADDRESS, CLAIMER_PORT, AGGKIT_IMAGE) consumed by compose.

• 🩹 e2e fix: agglayer_status (agglayer_certificate_status.sh --wait) now
  retries on the transient agglayer error raised right after the network starts,
  before the node has classified the network:

  ERROR: get network info: failed to get network info: Code: NotFound,
  Message: Network type could not be determined,
  Details: [Reason: GET_NETWORK_INFO_ERROR_KIND_UNKNOWN_NETWORK_TYPE,
  Domain: agglayer-node.grpc-api.v1.node-state-service.get_network_info. ]
  

  waitForSettled previously aborted on any GetNetworkInfo error, making the
  e2e prepare_network.sh step fail intermittently. This specific error is now
  treated as transient and polling continues (respecting the configured interval
  and timeout); other errors still abort.

⚠️ Breaking Changes

• None.

📋 Config Updates

• New env-var driven setup for the exit_certificate_claimer (see .env.example).
  No changes to the existing TOML config.

✅ Testing

• 🖱️ Manual:
  • make build-tools / go build ./tools/exit_certificate/... ./tools/exit_certificate_claimer/... build cleanly.
  • From tools/exit_certificate_claimer/docker/: cp .env.example .env then
    docker compose up --build starts the exit_certificate_claimer serving on CLAIMER_PORT.
  • exit_certificate_claimer healthcheck verified against a live health endpoint
    (exit 0) and a closed port (exit 1).
• 🧪 Unit: go test ./tools/exit_certificate/scripts/agglayer_status/ covers the
  new retry-on-undetermined-network-type path;
  go test ./tools/exit_certificate_claimer/... covers the healthcheck probe
  (URL building, 200/non-200/unreachable, end-to-end against the real router).
• 🚀 E2E: the exit-certificate tool E2E (CI) runs the claim step with
  CLAIMER_MODE=docker, validating the full docker deployment end to end:
  compose build of the aggkit image, container startup deriving the config,
  in-container L1 sync, /claimer/v1/health readiness and claiming every bridge
  exit against the containerized service.

📝 Notes

• The exit_certificate_claimer runs from the same working directory the
  exit_certificate tool used (config + output/), so no separate config file is needed.
• PR base: feature/exit-certificate-tool (packaging/deployment work only).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
85.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[joanestebanr]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: f944a5f07b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".