[NeoPlays]

MEV relay cleanup, Holesky retirement, and lint/dep fixes

Health-checked every relay, retired Holesky from the offering, and fixed the Ansible lint tooling that had never actually been running.

6fc0e928 MEV relay fixes

Checked all 11 relay entries (18 URLs) against mev-boost's /eth/v1/builder/status plus a delivered-payload query. Four hostnames were NXDOMAIN (verified via 1.1.1.1 and 8.8.8.8):

• BloXroute MAX PROFIT and Manifold: mainnet-only entries, removed outright
• Ultra sound money and Titan Relay Holesky endpoints: removed

Also: Flashbots Sepolia was live and delivering, but Stereum shipped pubkey 0x845bd072... against the advertised 0xafa4c698.... A stale pubkey makes mev-boost reject every bid as an invalid signature, so Sepolia's only relay was silently useless. Fixed.

793be64c Holesky removed from the offering

Follows the repo's existing pattern for retired networks (goerli and prater remain in backend maps but not networkList). Removed Holesky from the network list, its 4 checkpoint-sync sources, the ConsensusSync mapping, the edit-page service filter, and the one-click Lido fee address.

Deliberately kept everything existing Holesky nodes depend on: NodeService.networks.holesky, the network-switch regexes, contract lookups, and the 2.4.2/2.4.4 migrations. A full scrub would break ValidatorAccountManager.js:74 for anyone still running one.

Adjacent bug fixed in the same switch: ConsensusSync keyed checkpoint sources off positional network ids, which had drifted. case 5 served Hoodi's sources but id 5 is OP Sepolia, so Hoodi users got no checkpoint sources at all. Now keyed off network name.

a3126f36 2.5.1 Ansible migration

New update-changes migration so existing servers get repaired, not just fresh installs: drops the two retired relays from the -relays entrypoint and refreshes the Sepolia pubkey. Diff-guarded, so it's a no-op once applied. Holesky relays untouched.

If every configured relay was retired, it leaves the config alone and warns. mev-boost won't start on an empty -relays, and picking a replacement is a censorship-policy decision.

Landed in 2.5.1 (2.5.0 has shipped). Adds molecule scenario 251 with five fixtures (mixed, sepolia, all-retired, already-healthy, holesky) and registers it in the CI matrix, which enumerates scenarios explicitly and would otherwise never have run it.

db17747f Working lint tooling

pyproject.toml requested molecule = {extras = ["docker-lint"]}, but molecule 25.12 declares no extras at all, so yamllint and ansible-lint were never installed. CI's pip install "molecule[docker.lint]" was the same no-op. Molecule 25+ also dropped the lint subcommand, so every lint: block in molecule.yml was dead code.

• Made yamllint and ansible-lint real dependencies
• Consolidated 18 byte-identical per-role configs into one controls/.yamllint
• Added lint-ansible.yml, gating on pull_request, the first Ansible check that actually gates a PR

yamllint blocks; ansible-lint is informational for now, as the tree carries ~4,850 findings.

88064c8f Dependency bump

Package	From	To
ansible	13.3.0	14.3.1 (core 2.21.3)
molecule	25.12	26.8.0
molecule-plugins	n/a	26.7.15
hetznercloud	n/a	2.8.0
docker	n/a	7.2.0
hcloud	n/a	2.23.0

Mirrored across 112 pip install lines in the workflow, adding == pins to the three packages CI previously installed unpinned so the two sides can't drift again.

c819c7c0, 0d8e6732 Integration test fixes

Prysm's key import can't work on an unsynced node, so the test now calls ValidatorAccountManager.initWallet() directly. That's the same function importKey calls first, so this keeps real wallet-generation coverage while dropping the import and its key-count assertions.

Running all 17 integration tests confirmed this is Prysm-specific: Lighthouse, Nimbus, and Teku all import fine unsynced. That sweep also caught Lodestar asserting a log line it no longer emits ("have same the config" is now "have the same config"), fixed in 0d8e6732.