feat: add devnet-7

[qu0b]

devnet-7 prep (terraform + ansible)

Per the review feedback on the devnet-6 diff: defaults only (egg config), 8282 out of genesis, reduced starting client set. Infra prep only — nothing is deployed; launch steps listed at the bottom.

Genesis / egg

• egg pinned to 6.1.3 (the glamsterdam-devnet-7 release: adds DEPLOY_EIP8282_CONTRACTS, re-mined 8282 addresses, new gloas defaults like MIN_BUILDER_WITHDRAWABILITY_DELAY=64, PAYLOAD_DUE_BPS=5000).
• values.env stripped to network identity + fork schedule (chain id, mnemonic, fork versions, BPO 1/2, gloas @ epoch 30, premines). All devnet-6 spec-param overrides (withdrawal type, validator balance, gas limit, churn/withdrawability, MIN_EPOCHS_FOR_DATA_COLUMN_SIDECARS_REQUESTS) are gone — egg defaults govern.
• DEPLOY_EIP8282_CONTRACTS=false — the builder deposit/exit contracts are not in genesis. They get deployed manually pre-gloas via scripts/deploy-eip8282.zsh (see below).

Topology (starting set)

• EL: ethrex, geth, nethermind · CL: all but grandine (prysm, lodestar, lighthouse, nimbus, teku)
• 15 CL×EL pairs × 200 validators (indices 0–3000, NUMBER_OF_VALIDATORS=3000), 4 buildoors (prysm-ethrex, lighthouse-geth, lodestar-ethrex, teku-nethermind), 1 bootnode (prysm+geth)
• terraform: state key infrastructure/devnet-7, CIDR 10.27.0.0/16; terraform validate passes

Cleanups relative to devnet-6

• lodestar --serveHistoricalState + checkpoint-sync workarounds dropped; devnet-6 host_vars experiments not carried over
• bootnode ENR seed lists point at hosts that will exist on devnet-7
• stale duplicate ethereum_node_el: nethermind key removed from bootnode.yaml (the later geth key was winning)
• checkpoint sync starts disabled (enable once checkpointz serves)
• sops files copied verbatim from devnet-6 (byte-identical, same pattern as devnet-5 → devnet-6)

scripts/deploy-eip8282.zsh (throwaway)

Deploys both contracts through the deterministic CREATE2 factory (0x4e59b4…956C, an egg well-known-contract predeploy) using the vanity-mined salts from ethereum/execution-specs#3091 (contract source: ethereum/sys-asm — master bytecode verified identical to egg 6.1.3 genesis code). Guards: factory presence, CREATE2 address re-derivation, refuses at/after gloas epoch, idempotent, post-deploy runtime + exit-inhibitor verification. check mode smoke-tested against live devnet-6.

Not in this PR / at launch

• pin ethereum_genesis_timestamp (currently falls back to now+45min)
• flip ansible/ansible.cfg default inventory + fact cache to devnet-7 (left on devnet-6 while it is live)
• kubernetes/devnet-7/ tooling + syncoor workflow
• glamsterdam-devnet-7 image tags must exist for the starting clients
• run scripts/deploy-eip8282.zsh after genesis, before epoch 30