fix(planner): guard validation gates in buildRunningPlan

[bdchatham]

Problem

A SeiNode validator with signingKey+nodeKey set but operatorKeyring unset comes up fine via the create path (buildBasePlan), but once it reaches Status.Phase == Running, the InPlace update path buildRunningPlan (internal/planner/validator.go) fails every reconcile that detects image/sidecar drift with:

validate-operator-keyring: secretName is empty

buildBasePlan builds its program incrementally and guards each validation gate with its needs* predicate (needsValidateSigningKey / needsValidateNodeKey / needsValidateOperatorKeyring). buildRunningPlan instead hardcoded all three into a fixed slice, so a Running validator with no operatorKeyring emits a validate-operator-keyring task whose params carry an empty secretName, and the task handler fails terminally.

This is a production blocker for the arctic-1 node-19 migration: validator-19 has signingKey+nodeKey and no operatorKeyring, so it would bring up cleanly but brick on its first image upgrade — the update plan would wedge before apply-statefulset/replace-pod. It was caught during a harbor dry-run of the migration.

Fix

Build the running-plan program incrementally with the same needs* guards as buildBasePlan, so an unset key source is skipped rather than validated as empty. This also repairs the genesis-ceremony-Running path (no key sources), which the old hardcoded slice would have failed on the empty signing-key gate.

Tests

• Unit (internal/planner/node_update_test.go): replaced the test that encoded the buggy behavior (empty ValidatorSpec{} asserting all three gates) with three cases — declared-keys-only (BYO, no operatorKeyring → operator-keyring gate absent), operatorKeyring-set (all three gates), and genesis-ceremony-Running (no gates).
• Integration (internal/controller/nodedeployment/envtest/inplace_rollout_validator_test.go): end-to-end against a real apiserver — seeds BYO key Secrets, brings a replicas:1 no-operatorKeyring validator to Running, bumps the image, and asserts the rollout completes (new image propagates, no child plan fails on the operator-keyring gate, SND reaches RolloutComplete). Verified it fails against the pre-fix code: the child plan latches validate-operator-keyring: secretName is empty and the test times out.

Review

Cross-reviewed by the kubernetes-specialist: verdict COMPATIBLE. Confirmed the fix mirrors buildBasePlan, audited every other program-builder path (buildBootstrapPlan, buildGenesisPlan, full/archive/replay planners, post-bootstrap progression) — none carries the same bug — and confirmed no skip-regression and no assembleUpdatePlan side effects from a variable-length program.

[cursor]

PR Summary

Medium Risk
Changes validator rollout task planning for production image upgrades; behavior is narrowly scoped to skipping validation when key sources are unset, with strong regression tests.

Overview
Running validator image/sidecar updates no longer always enqueue signing, node, and operator-keyring validation tasks. buildRunningPlan now builds the task list with the same needsValidate* guards as buildBasePlan, so validators with only BYO signing/node keys (no operatorKeyring) can roll without failing on an empty operator-keyring secret.

Tests replace the old “always three gates” unit expectation with cases for declared-keys-only, operator keyring set, and genesis-ceremony Running with no gates; an envtest drives a full in-place image bump for that BYO shape and asserts rollout completion without operator-keyring failures.

^{Reviewed by Cursor Bugbot for commit 8aacebb. Bugbot is set up for automated code reviews on this repo. Configure here.}