chore(ops): upgrade ops tooling

[SimonRastikian]

No description provided.

[claude]

PR title type suggestion: This PR updates ops tooling and scripts, so the type prefix should probably be chore: instead of Ops/.
Suggested title: chore: upgrade ops tooling

[claude]

Pull request overview

Introduces a new scripts/ops/ operator tooling directory containing shell helpers to (1) cut a release, (2) prepare local upgrade artifacts (WASM download, borsh-encoded serialized.bin, docker manifest digests), (3) print ready-to-run propose/vote NEAR CLI commands for a given net, and (4) show read-only upgrade status. Adds a shared lib.sh with strict-mode/ERR-trap plumbing, an interactive menu.sh, and moves the existing prepare-release.sh under scripts/ops/, updating RELEASES.md and .cliffignore references. Phase 0 — read-only / local only; nothing submits transactions or mutates a running node.

Changes:

• New scripts/ops/{lib.sh,menu.sh,upgrade-prepare.sh,upgrade-commands.sh,upgrade-status.sh,README.md}
• Moved scripts/prepare-release.sh → scripts/ops/prepare-release.sh (small export GITHUB_TOKEN split for set -u correctness while at it)
• Updated RELEASES.md and .cliffignore for the new path

Reviewed changes

Per-file summary

File	Description
.cliffignore	Update path reference to relocated script.
RELEASES.md	Update path references (scripts/prepare-release.sh → scripts/ops/prepare-release.sh).
scripts/ops/README.md	New: overview of the operator tooling, scope, conventions, phase-0 roadmap.
scripts/ops/lib.sh	New: strict mode, ERR trap, run, require_cmds, validate_version, resolve_net, node_digest.
scripts/ops/menu.sh	New: interactive select-menu dispatcher for the four ops actions.
scripts/ops/prepare-release.sh	Renamed from scripts/prepare-release.sh; GITHUB_TOKEN set/export split.
scripts/ops/upgrade-commands.sh	New: emits propose_update / vote_update / (TEE only) vote_code_hash sample commands.
scripts/ops/upgrade-prepare.sh	New: downloads contract tarball via gh release download, hand-rolls borsh ProposeUpdateArgs into serialized.bin, prints sha256 + docker manifest digests.
scripts/ops/upgrade-status.sh	New: read-only near contract call-function as-read-only queries + optional curl of node :8080/metrics.

Findings

Blocking (must fix before merge):

• scripts/ops/README.md:4 and scripts/ops/README.md:22-24 — The README's scope paragraph and the runbook column in the Scripts table point at how-to/contract-upgrade.md, how-to/node-hash-vote.md, how-to/cluster-upgrade.md, and the directory ../../how-to/. None of those files or the how-to/ directory exist in this repo (verified with find). Every runbook link is broken, and the README's own framing ("automate the mechanical, error-prone parts of the runbooks in `how-to/` — they do not replace them; read the relevant runbook alongside") is undermined without them. Either land the referenced runbooks in the same PR, or drop the broken links and reword the scope statement until Phase 1 introduces them. Per CLAUDE.md's Documentation alignment section, doc drift on introduction is review-blocking.
• scripts/ops/lib.sh:6, scripts/ops/upgrade-prepare.sh:8, scripts/ops/upgrade-commands.sh:7-8, scripts/ops/upgrade-status.sh:6-7 — Same issue in script header comments ("See how-to/…"). Operators following these hints hit dead ends. Update or remove alongside the README fix.

Non-blocking (nits, follow-ups, suggestions):

• scripts/ops/upgrade-prepare.sh:41-51 — The borsh layout for ProposeUpdateArgs (\x01 + <I len + wasm + \x00) is hand-rolled in Python and will silently produce a corrupt payload if the contract's ProposeUpdateArgs ever gains/reorders a field (e.g. a new Option<…> before/after config, or a non-Option field). Since a bad serialized.bin only surfaces at propose_update time on-chain, consider either (a) invoking a tiny Rust helper that borsh-serializes the real ProposeUpdateArgs type, or (b) adding a sanity check that re-parses the blob with a matching Rust deserializer as part of cargo make check-all-fast. At minimum, a TODO(#issue) comment pointing at the contract type so the coupling is discoverable would help.
• scripts/ops/lib.sh:53-60 — NET_DEPOSIT values (20 NEAR / 16 NEAR) are static constants in shell. If the contract raises its required deposit for propose_update, this drifts silently and operators see cryptic on-chain errors. Not fixable here without a chain call, but worth a comment pointing at the contract-side source of truth (crates/contract/…) so the next bump is one grep away.
• scripts/ops/upgrade-status.sh:38 — curl -sf | grep mpc_node_build_info with pipefail + set -e is correctly caught by the trailing || echo, but that same || swallows the distinction between "node unreachable" (curl failed) and "curl succeeded, metric absent" (grep failed). Two different failure modes conflated into one message. Trivial to split with an intermediate variable if operators find this ambiguity a problem in practice; fine to defer.
• scripts/ops/upgrade-prepare.sh:23-31 — The downloaded mpc-contract-vX.Y.Z.tar.gz is never cleaned up, and unlike the .wasm (which has a "delete it to re-download" hint) there's no note on lifecycle. Minor; consider either removing the tarball after extraction or documenting that both artifacts persist.
• scripts/ops/menu.sh:44 — read -rp \"Node IPs …\" -a ips skips the ask helper (which rejects empty input) because empty is legitimately optional here. That's fine, but there's no validation of the IPs either — a mistyped hostname just becomes an "unreachable" line downstream. Acceptable for an operator-facing tool.

⚠️ Issues found