sentinel: add multicast publisher worker with e2e tests

Add standalone multicast publisher sentinel that automatically detects
IBRL validators and creates multicast publisher users on-chain. Includes
e2e test infrastructure with validator-metadata-service-mock container.

Author: snormore

.github/workflows/e2e.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches: [ main, 'hotfix/**' ]
   pull_request:
-    branches: [ main, 'hotfix/**' ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -25,6 +24,8 @@ env:
   DZ_CLIENT_IMAGE: ghcr.io/malbeclabs/dz-e2e/client:${{ github.sha }}
   DZ_DEVICE_HEALTH_ORACLE_IMAGE: ghcr.io/malbeclabs/dz-e2e/device-health-oracle:${{ github.sha }}
   DZ_GEOPROBE_IMAGE: ghcr.io/malbeclabs/dz-e2e/geoprobe:${{ github.sha }}
+  DZ_SENTINEL_IMAGE: ghcr.io/malbeclabs/dz-e2e/sentinel:${{ github.sha }}
+  DZ_VALIDATOR_METADATA_SERVICE_MOCK_IMAGE: ghcr.io/malbeclabs/dz-e2e/validator-metadata-service-mock:${{ github.sha }}
 
 jobs:
   setup:
@@ -63,6 +64,8 @@ jobs:
           docker push ${{ env.DZ_IMAGE_REPO }}/client:${{ env.DZ_IMAGE_TAG }}
           docker push ${{ env.DZ_IMAGE_REPO }}/device-health-oracle:${{ env.DZ_IMAGE_TAG }}
           docker push ${{ env.DZ_IMAGE_REPO }}/geoprobe:${{ env.DZ_IMAGE_TAG }}
+          docker push ${{ env.DZ_IMAGE_REPO }}/sentinel:${{ env.DZ_IMAGE_TAG }}
+          docker push ${{ env.DZ_IMAGE_REPO }}/validator-metadata-service-mock:${{ env.DZ_IMAGE_TAG }}
       - name: Discover tests and distribute across shards
         id: shard
         working-directory: e2e/
@@ -176,6 +179,8 @@ jobs:
           pull_with_retry ${{ env.DZ_IMAGE_REPO }}/client:${{ env.DZ_IMAGE_TAG }}
           pull_with_retry ${{ env.DZ_IMAGE_REPO }}/device-health-oracle:${{ env.DZ_IMAGE_TAG }}
           pull_with_retry ${{ env.DZ_IMAGE_REPO }}/geoprobe:${{ env.DZ_IMAGE_TAG }}
+          pull_with_retry ${{ env.DZ_IMAGE_REPO }}/sentinel:${{ env.DZ_IMAGE_TAG }}
+          pull_with_retry ${{ env.DZ_IMAGE_REPO }}/validator-metadata-service-mock:${{ env.DZ_IMAGE_TAG }}
           pull_with_retry quay.io/prometheus/prometheus:v2.54.1
           pull_with_retry public.ecr.aws/influxdb/influxdb:1.8
       - name: test

.github/workflows/flow_schema_migrations.yml

@@ -7,7 +7,6 @@ on:
   pull_request:
     paths:
       - "telemetry/flow-enricher/clickhouse/**"
-    branches: [ main, 'hotfix/**' ]
 
 jobs:
   validate:

.github/workflows/go.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches: [ main, 'hotfix/**' ]
   pull_request:
-    branches: [ main, 'hotfix/**' ]
 
 jobs:
   go-build:

.github/workflows/release.pipeline.validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [ main, 'hotfix/**' ]
   pull_request:
-    branches: [ main, 'hotfix/**' ]
 
 permissions:
   contents: write

.github/workflows/rust.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches: [ main, 'hotfix/**' ]
   pull_request:
-    branches: [ main, 'hotfix/**' ]
 
 jobs:
   rust-build:

.github/workflows/sdk.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches: [ main, 'hotfix/**' ]
   pull_request:
-    branches: [ main, 'hotfix/**' ]
 
 jobs:
   sdk-version-check:

.github/workflows/shreds-e2e.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches: [main, 'hotfix/**']
   pull_request:
-    branches: [main, 'hotfix/**']
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}

CHANGELOG.md

@@ -13,6 +13,8 @@ All notable changes to this project will be documented in this file.
   - Reset SIGPIPE to SIG_DFL at the start of main() in all 3 CLI binaries (doublezero, doublezero-geolocation, doublezero-admin) so the process exits silently like standard CLI tools
   - Support `--type outbound-icmp` in geolocation `user add-target`, `remove-target`, and `get` commands
   - Add sentinel admin commands to find and create multicast publishers for IBRL validators
+- Sentinel
+  - Add standalone multicast publisher sentinel that automatically detects IBRL validators and creates multicast publisher users on-chain
 - SDK
   - Add Go SDK for shred subscription program with read-only account deserialization (epoch state, seat assignments, pricing, settlement, validator client rewards), PDA derivation helpers, RPC fetchers, compatibility tests, and a fetch example CLI
   - Add `GeoLocationTargetTypeOutboundIcmp` to Go geolocation SDK with deserialization and round-trip test support

Cargo.lock

@@ -68,6 +68,7 @@ ipnetwork = "0"
 libc = "0"
 log = "0"
 metrics = "0"
+metrics-exporter-prometheus = "0"
 metrics-util = "0"
 mockall = "0"
 reqwest = "0"
@@ -93,6 +94,10 @@ tabled = "0"
 temp-env = "0"
 tempfile = "3"
 thiserror = "2"
+tokio-util = "0"
+tracing = "0"
+tracing-subscriber = { version = "0", default-features = true, features = ["env-filter", "fmt", "registry"] }
+url = "2"
 strum = "0.26"
 strum_macros = "0.26"
 tokio = { version = "1", default-features = false, features = [