Add post-Savanna TelosZero node and finalizer templates

[TheJudii]

Summary

• replace the legacy Leap-oriented setup with TelosZero Core 1.2.2 guidance for the post-Savanna steady state
• add producer, paused backup-producer, vote-relay, API, and SHiP profiles for mainnet and testnet
• add a finalizer runbook covering BLS key generation, registration, native-policy and vote verification, failover, rotation, recovery, and decommissioning
• add instance-specific systemd deployment, hardened compatibility runners, protected finalizer storage, and fail-closed producer defaults
• refresh verified peer lists and add a guarded peer-generation tool
• add template validation, lifecycle tests, real-nodeos smoke tests, and GitHub Actions CI

Why

The existing template targeted an older Leap deployment model and did not cover the BLS finalizer responsibilities introduced by Savanna instant finality. Block producers now need safe finalizer-key custody, persistent safety.dat handling, vote-capable relay paths, and operational procedures for rotation and failover.

These templates presume Savanna instant finality is already active; they do not cover one-time network activation choreography.

Operator impact

Operators can render a reviewed configuration for each node role while keeping producers private and vote relays correctly configured. Producer templates require separate K1 and BLS signing keys, unique per-instance finalizer state, and retain the production pause guard when finalizer votes disappear.

Existing installations should review and render the new profiles rather than replacing live configuration blindly. The compatibility runner refuses stale production and unsupported command-line overrides by default; systemd is the recommended production path.

Validation

• scripts/validate.sh
• ShellCheck across all shell scripts
• systemd-analyze verify systemd/[email protected]
• Python peer-updater unit tests
• runner lifecycle and duplicate-start tests
• TelosZero Core 1.2.2 package checksum verification
• real nodeos parsing/startup smoke tests for all ten mainnet/testnet role combinations