refactor(seinetwork): move CR-read sites onto canonical sei.io/seinetwork keys (Wave A)

[bdchatham]

Wave A of the sei.io/nodedeployment→sei.io/seinetwork nomenclature migration: move the code that reads/selects SeiNode CRs onto the canonical keys. Zero pod roll; the internal-Service pod selector (Wave B) and the label stamp are untouched.

What

• labels.go — split the shared selector: groupSelector stays on the frozen nodedeployment key for the internal ClusterIP Service pod selector; new seinetworkSelector (canonical) backs CR-listing.
• Repointed the CR-read sites: nodes.go (listChildSeiNodes, scaleDown list + ordinal parse), per_pod_services.go (ordinal read), cmd/main.go (assembler-node select), internal/task/await_nodes_running.go (listTargetNodes — confirmed lists SeiNodeList, not pods).
• API doc-comments now describe seinetwork as primary / nodedeployment as retained-for-continuity; regenerated CRD YAML (description-only, no served-schema/CEL change).

Why it's a no-op / zero-roll

Every SeiNetwork child is dual-stamped with both key families, and all these read-sites are SeiNetwork-children-scoped (list by sei.io/seinetwork=<network.name> within a SeiNetwork reconcile), so the selected set is identical. The internal-Service pod selector and the stamp are unchanged → nothing rolls. Standalone SeiNodes (not children of any SeiNetwork) are never selected by these sites.

Kept for Wave B / follow-up

• internal_service.go:94 pod-selector flip — Wave B, gated on the fleet fully cycling (kubectl get pods -A -l 'sei.io/nodedeployment,!sei.io/seinetwork' empty).
• Hoisting a shared api/v1alpha1 const for sei.io/seinetwork (retire the raw literals + sdk/sei's aspirational "single source of truth") — endorsed follow-up.

Review

/xreview — Class component, T2. kubernetes-specialist (dissenter) + idiomatic-reviewer: both RATIFY. Verified pod-selector + stamp untouched, all migrated sites are CR readers, the selector split is correct, CRD diff description-only. Deployment precondition empirically verified: all 15 SeiNetwork-child SeiNodes on harbor carry the canonical label (prod's standalone nodes correctly don't, and are never selected). Build + seinetwork/task tests + envtest green.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches child discovery, scale-down, status derivation, and plan tasks; rollout risk is low only if every SeiNetwork child is dual-labeled—missing sei.io/seinetwork would drop nodes from lists while the internal Service still routes via the frozen pod key.

Overview
Wave A of the sei.io/nodedeployment → sei.io/seinetwork migration: controller code that lists or reads child SeiNode CRs now keys off the canonical labels, without changing what gets stamped on pods or how the internal Service selects pods.

labels.go introduces seinetworkSelector for CR work while groupSelector stays on the frozen sei.io/nodedeployment key for the internal ClusterIP Service pod selector only (documented so Wave B does not flip traffic early). Call sites move to the canonical key/ordinal: listChildSeiNodes, scaleDown, populatePerPodServices, genesis assembler-node listing in cmd/main.go, and await-nodes-running’s default list path.

API and regenerated CRD YAML updates are description-only, framing sei.io/seinetwork as primary for controller CR-selection and nodedeployment as retained for GitOps continuity. Tests follow the new label constants.

^{Reviewed by Cursor Bugbot for commit 8e5d2fa. Bugbot is set up for automated code reviews on this repo. Configure here.}