Bump gcp measure script version

Order ssh-pubkey-server after dropbear instead of requiring
searcher-container, and serve both host keys via the generic
--ssh-pubkey-file flag. Generate the dropbear .pub in dropbear-prereq so
the control-plane key exists at boot.

This makes the attested pubkey channel available before disk init, so the
searcher can attest the host key before their first SSH instead of
trusting it on first use (TOFU). The container key is served lazily by
/pubkey once it appears after the disk is unlocked.

Pin ssh-pubkey-server to v0.1.0 (lazy available-subset serving) and update
the L1 readme accordingly.

…ple-pubkey-server

Decouple ssh-pubkey-server from the searcher container

* flashbox-l1: allowlist BuilderNet bottom-of-block endpoints (production only)

Add a temporary egress allowlist for the new BuilderNet bottom-of-block
endpoints so a searcher can connect to a specific pre-configured builder
instance for testing.

These 6 IPs serve both the tx stream (persistent wss, path /bob) and bundle
submission (bare path) over the same HTTPS endpoint, so they cannot be split
into an always-on bundle rule + production-only tx stream rule the way the
Flashbots/Titan endpoints are. Since tx stream is an observable side channel,
the whole set is gated to production mode.

- firewall-config: add 6 BuilderNet IPs to PRODUCTION_OUT (HTTPS/443)
- toggle-config: add the same IPs to PRODUCTION_ENDPOINTS so tx-stream flows
  are torn down via conntrack when leaving production mode
- searcher-container-after-init: add static /etc/hosts entries (US nodes first)
  so the searcher connects by hostname and TLS validates without DNS

Tradeoff: BuilderNet bundle submission only works in production mode, unlike
the Flashbots/Titan bundle endpoints which are always on.

* flashbox-l1: reword BuilderNet endpoint comments to be purely descriptive

Drop the "temporary test allowlist" framing and other non-descriptive notes
from the BuilderNet egress comments across firewall-config, toggle-config, and
searcher-container-after-init. The comments now describe only what the config is
and why it is shaped this way.

BuilderNet IPs are allowlisted in PRODUCTION_OUT and torn down on toggle
via toggle-config PRODUCTION_ENDPOINTS, but were missing the MAINTENANCE_OUT
drop that the Flashbots tx-stream endpoints already have.

Because MAINTENANCE_OUT accepts HTTPS to any IP (catch-all), the BuilderNet
endpoints -- which carry the tx-stream side channel on 443 -- were reachable
in maintenance mode, contradicting their production-only intent. Add the drop
before the accept-all rules, mirroring the Flashbots Protect tx-stream
treatment.

flashbox-l2 reviewed: it has no BuilderNet endpoints (production-only egress
is the simulator, already dropped in maintenance), so no change needed there.

* flashbox-l1: document BuilderNet bottom-of-block in readme

BuilderNet bottom-of-block order flow is now live, with the same API format as
Titan's. Document it alongside the existing Flashbots/Titan order-flow sections.

- Add "Searching on BuilderNet's Bottom of Block" section: state diff stream
  (eth_subscribe / flashbots_stateDiffs) on wss://rpc.buildernet.org/bob and
  bundle submission (eth_sendBobBundle) on https://rpc.buildernet.org. Format
  mirrors Titan; both share one HTTPS endpoint so both are production-only.
- Add the section to the table of contents.
- Add a BuilderNet row to the firewall rules table (443, production only).
- List BuilderNet in the intro line of supported order flow.
- Fix DNS row port in the firewall table (54 -> 53).

* Added note on readme

---------

Co-authored-by: pablin-10 <118397961+pablin-10@users.noreply.github.com>

Titan Builder's bottom of block is no longer supported, so remove its endpoints
from the image config and documentation entirely.

Code (modules/flashbox/flashbox-l1/mkosi.extra/etc/bob/):
- firewall-config: drop TITAN_* vars, the ALWAYS_OUT Titan bundle rule, and the
  PRODUCTION_OUT Titan state diff rule; update BuilderNet comments that compared
  against "Flashbots/Titan" to just "Flashbots".
- toggle-config: drop the Titan entry from PRODUCTION_ENDPOINTS.
- searcher-container-after-init: drop the fbtee.titanbuilder.xyz /etc/hosts entry.

Docs (readme.md):
- Remove the "Searching on Titan Builder's Bottom of Block" section, its TOC
  entry, the two Titan firewall-table rows, and the intro-line mention; drop the
  comparative Titan mention from the BuilderNet section.

…proxy

flashbox - switch cvm-reverse-proxy to attested-tls-proxy

* Add reusable build+publish workflow for flashbox-l1
---------

Co-authored-by: Niccolo Raspa <niccoloraspa@gmail.com>