test: harden Gloas harness and CI

[AntiD2ta]

TL;DR

Live and stub coverage for the Gloas HTTP endpoints, the fork gates that decide when the live tests run, and a CI job that makes those gates fail loudly instead of skipping.

Where to start

1. testclients/forkutil.go (56 lines). The three fork probes everything else is gated on. OnGloas compares the head's fork version against GLOAS_FORK_VERSION. Both are config values, so it needs no block download and does not care whether the node's preset matches the compiled-in one.
2. http/gloasgate_test.go. The gate, and HTTP_REQUIRE_GLOAS switching it from skip to fail.
3. http/main_test.go. Harness setup. There is one address knob, HTTP_ADDRESS. HTTP_REQUIRE_GLOAS sets severity only and is not a second endpoint.
4. The per-endpoint tests: epbsproposal, executionpayloadenvelope, submitproposal, submitexecutionpayloadbid, submitexecutionpayloadenvelope.
5. .github/workflows/http-tests.yml (30 lines). The only change outside testclients/ and http/.

How to run it

HTTP_ADDRESS=<gloas node> HTTP_REQUIRE_GLOAS=true \
  go test -v -run 'Gloas|EPBS|ExecutionPayload' ./http/...

Without HTTP_ADDRESS, TestMain returns before m.Run, so the package reports ok having run nothing. Worth knowing when reading a green log.

Dependency and review order

Review after the event-forwarding PR. Base is review/gloas-events-multi-client.

Public API

One addition outside a _test.go file. testclients/forkutil.go exports KnowsGloas, OnGloas and HeadVersion, and only package http_test consumes them. Say if you would rather they lived there.

Behaviour-sensitive checks

The Gloas job needs two repository settings before it does anything: the HTTP_ADDRESS_GLOAS variable, and the HTTP_BEARER_TOKEN_GLOAS secret if the endpoint is authenticated. Without the variable the job is skipped, so forks and branches with no devnet to point at are unaffected. With it, the job maps that variable to HTTP_ADDRESS and sets HTTP_REQUIRE_GLOAS=true, so a gate that skips fails the job.

The job's -run pattern is scoped by name rather than running the whole package. Post-Gloas block production is v4-only, so the v3 tests in ./http/... fail permanently against a Gloas node for reasons the job is not about. A new Gloas live test needs a name matching that pattern to be picked up.

Validation

go test ./...: 2,510 tests. Seven packages (spec/phase0, spec/bellatrix, spec/capella, spec/deneb, spec/electra, api/v1, api/v1/deneb) fail locally on go1.27 with jsontext error-string mismatches. None of those files are in this diff, and CI pins go1.25.2.

go test -race -p 1 ./http/... ./testclients/...: pass. go vet and gofmt: clean.

The gloas job has now run against glamsterdam-devnet-8. 25 tests, 0 skips, so the gates resolve and the live tests execute rather than quietly opting out. 24 pass, and TestEPBSProposal fails on 2 of its 4 rows. Neither cause is in this diff:

• TestEPBSProposal/SSZPayloadExcluded and SSZPayloadIncluded fail with "no Eth-Execution-Payload-Included header in epbs proposal response". Asked with the Accept: application/octet-stream;q=1,application/json;q=0.9 header the client sends, the node answers 200 with content-type: application/octet-stream and sends Eth-Consensus-Version, Eth-Consensus-Block-Value and Eth-Execution-Payload-Value, but no Eth-Execution-Payload-Included. The SSZ path in epbsProposalFromResponse has nowhere else to read the flag, so it cannot succeed against this node. Both JSON rows pass, because the JSON path reads the flag from the body.
• Live block production on this devnet answers 500 no cached P2P bid available for roughly 6 requests in 10, whichever value include_payload takes. TestSubmitProposalGloas fails on that locally and passed in CI on a luckier slot, so any live production test on a Gloas devnet needs to expect it.

Since the last push

• OnGloas no longer fetches the head block. Any error on that path was swallowed and made every Gloas live test skip with "head is unknown", so the gate could fail open on a node that does not serve the block endpoint, or whose preset the compiled-in codec cannot decode. Comparing fork versions removes both.
• The SSZ rows of TestEPBSProposal and the block production in TestSubmitProposalGloas now use a custom-spec service, which is what the comments already claimed.
• disagreeingService fronts the live node with a reverse proxy and passes WithAddress to New, instead of writing s.base after New had already handed the service to periodicUpdateConnectionState. That write was a data race go test -race reports whenever HTTP_ADDRESS is set.
• TestEPBSProposal re-reads the head slot per subtest, so the later rows do not ask a devnet to build for a slot it has passed.
• Assertions moved out of httptest handler goroutines, where a failure calls runtime.Goexit outside the test's goroutine and surfaces as a transport error naming nothing.
• The envelope sentinel test names the head slot instead of underflowing phase0.Slot when the head is below slot 100.