refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply

[bussyjd]

Why

CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).

Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.

Before

   obol stack up           obol sell pricing
        |                       |
        v                       v
   stack.Up()              EnsureVerifier()
        |                       |
        v                       v
   defaults.CopyInfra      reads embed.FS x402.yaml
   $OBOL_CONFIG_DIR        applies DUPLICATE rewrite regex
   /defaults/x402.yaml     kubectl apply
   (dev-rewritten           |
    via canonical regex)    v
        |              OVERWRITES the helmfile-managed Deployment
        v              with whatever embed.FS+duplicate-regex produced
   helmfile -l base
   sync                <- fighting EnsureVerifier on every cycle
        |
        v
   Deployment ends up in whichever order won the race

After

   obol stack up           obol sell pricing
        |                       |
        v                       v
   stack.Up()              EnsureVerifier()
        |                       |
        v                       v
   defaults.CopyInfra      RefreshInfrastructureIfChanged() (no-op if recent)
   $OBOL_CONFIG_DIR        helmfile --selector name=base sync
   /defaults/x402.yaml          |
   (dev-rewritten              v
    via canonical regex)   single source of truth
        |                  zero duplicate code
        v
   helmfile -l base sync

What changed

• internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
• internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
• Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.

Call sites of EnsureVerifier reviewed

Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.

Other duplicate-regex copies in the codebase

Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.

Test plan

• go build ./... clean
• go test ./internal/x402/... green (24 packages, structural test passes)
• go test ./internal/defaults/... green
• TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
• TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
• Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)

Closes

CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.