fix(seismic-node): disable trace_* and ots_* RPC namespaces (Veridise 1207)

[samlaf]

Trace-serving endpoints expose execution metadata — gas usage, revert paths, call-tree shape, touched addresses — that is a side channel on Seismic's private state even after payload sanitization strips calldata, return data, memory, stack, and storage diffs. We agree with the audit recommendation to disable tracing entirely rather than rely on sanitization alone.

Prior state: debug_* was already removed wholesale at RPC startup (#390), and payload sanitizers were wired into every debug/trace handler (#354), with the sanitizer logic centralized in seismic-revm-inspectors. The gap the finding identifies is real — the trace_* namespace remained registrable, and ots_* (Otterscan) wraps the same tracing internals (ots_traceTransaction returned unsanitized call-tree data until #405).

This removes the two remaining trace-serving namespaces at RPC startup, in one loop alongside debug_*, regardless of the operator's --http.api selection (so an explicit --http.api trace,ots cannot re-expose them):

• trace_*: parity-style tracing; also honors a caller-supplied from without the sanitization eth_call applies
• ots_*: Otterscan endpoints

Defense in depth, should tracing ever be re-enabled: the payload sanitizers in crates/rpc/rpc/src/{debug,trace}.rs and the ots_* handler sanitization (#405, Veridise 1085) stay in place. The intent is that any future re-enablement serves only sanitized traces; fully unsanitized traces are meant only for local dev nodes (sanvil), where there is no private state to protect.

If tracing is ever reintroduced, we will treat all returned metadata as sensitive and audit the sanitizers from first principles, including applying the same from-sanitization that eth_call uses.

Add an e2e regression test that launches a node with all namespaces configured and asserts debug_/trace_/ots_* methods return method-not-found while eth_blockNumber still works; this also backfills coverage for the earlier debug_* removal, which shipped without a test.

Also disable IPC on e2e test node launches (shared test_rpc_server_args helper): tests talk to nodes over local HTTP only, and the default IPC endpoint is a global /tmp socket that sandboxed environments forbid binding.

[github-actions]

Disables trace-serving RPC namespaces (debug_, trace_, ots_*) on Seismic nodes to prevent metadata side-channel attacks on private state.

Phase 2

• crates/seismic/node/src/node.rs:391 — The loop processes RethRpcModule::{Debug,Trace,Ots} but there's no check whether these modules were actually configured. If an operator doesn't enable trace namespaces, methods_by_module() returns an empty iterator, so this is safe but adds unnecessary work. Consider an early if !modules.module_config().contains_any(&module) check.

Phase 3

• crates/e2e-test-utils/src/lib.rs:49 — Good refactoring. The test_rpc_server_args() helper centralizes the IPC disable logic and reduces duplication.
• crates/seismic/node/tests/e2e/integration.rs:1713 — Comprehensive test coverage, and correctly uses setup_test_node() which uses SEISMIC_DEV chain spec rather than vanilla Ethereum.

LGTM — The security hardening is well-reasoned and properly implemented.