test(seed): cover seed reconcile against a live manager

[bdchatham]

Follow-up to #499, closing a coverage gap I flagged when it merged.

The gap

The seed admission tests added in #499 live in internal/controller/node/envtest, which runs no reconciler — it's a client against a CRD-loaded apiserver. They pin the CEL contract (required nodeKey, exactly-one, secretName immutability) and nothing else.

Reconcile-level coverage lives in seinetwork/envtest, which despite the name starts a real manager with both SeiNodeReconciler and SeiNetworkReconciler (suite_test.go:140,172,196). There was no seed equivalent there, so nothing verified that a seed converges to a StatefulSet it can actually run under.

What's covered

Every assertion is a concrete way seid would fail, not a shape restatement:

Test	Guards against
ReconcilesToSeedShapedStatefulSet	cosmos-exporter blocking forever on a gRPC port a seed never binds; /lag_status readiness that can never answer, so the pod never reaches Ready; missing GOMEMLIMIT on a request==limit footprint
MountsNodeKeyFromSecret	an identity left to seid init, which regenerates on the data volume and breaks every client holding the published NodeID. Also pins subPath + read-only, so a Secret edit cannot swap the identity under a running seid
SchedulesOnTheSeedNodepool	a seed inheriting the RPC-class default pool, which karpenter.sh/do-not-disrupt then pins. Asserts the fixture's seed pool differs from the default, so the test cannot pass vacuously
TakesGenesisProgressionAndIsNotStateSyncGated	validate-node-key and configure-genesis present, snapshot-restore and configure-state-sync absent, and StateSyncReady resolving False/NotApplicable rather than staying absent per the conditions doctrine

The last is the first coverage of a seed's plan against a live reconciler rather than a direct planner call.

Verified by mutation, not just green

Mutating servesSeidRPC to return true — treating a seed as an RPC-serving node — fails TestSeed_ReconcilesToSeedShapedStatefulSet on the cosmos-exporter assertion, with the container's until (exec 3<>/dev/tcp/localhost/9090) wait loop right there in the diff output. That is the exact crash-loop the predicate prevents.

(First mutation attempt was a bad one — I disabled cosmos-exporter for all modes rather than enabling it for seed, and the test correctly still passed. Worth noting because a mutation that doesn't fail isn't automatically evidence the test is weak.)

Test

Full integration suite green: node/envtest 70s, seinetwork/envtest 120s, nodetask/envtest 11s. Tests only — no source changes.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Test-only change with no production code paths modified.

Overview
Adds envtest reconcile tests for seed SeiNode resources under internal/controller/seinetwork/envtest, where a real controller manager runs (unlike seed admission tests in node/envtest, which only exercise CEL against the apiserver).

The new suite creates seed nodes and waits for convergence, then asserts runtime-critical outcomes: a single seid container with no cosmos-exporter, TCP P2P readiness on 26656 instead of RPC HTTP probes, GOMEMLIMIT set, node-key Secret volume mount with read-only subPath, scheduling on the dedicated seed nodepool (affinity/tolerations), and a genesis-only plan (validate-node-key, configure-genesis; no snapshot/state-sync tasks) with StateSyncReady reported False / NotApplicable.

^{Reviewed by Cursor Bugbot for commit e49816f. Bugbot is set up for automated code reviews on this repo. Configure here.}