feat(e2e): add Union channel and ERC20 scenario runner

[notJoon]

Summary

This PR adds a resumable Go-based E2E runner for the live
Union–EVM–Gno IBC path.

It manages a pinned Voyager runtime, establishes the IBC topology, runs the
selected packet scenarios, and stores checkpoints and review evidence. Chains,
PostgreSQL, Gno realms, and EVM contracts must already be deployed.

Structure

e2e/union/
├── cmd/channel-e2e/       CLI entrypoint and flags
├── internal/config/       environment validation and Voyager config
├── internal/scenario/     orchestration and scenario acceptance checks
├── internal/state/        checkpoints and evidence persistence
├── internal/voyager/      Voyager lifecycle, clients, and handshakes
├── internal/evm/          EVM transactions, logs, and balances
├── internal/gno/          gnokey/qeval, events, and packet queries
├── internal/union/        Union membership-height queries
├── internal/process/      external command execution seam
├── run-channel-e2e.sh
└── voyager-build.Dockerfile

scenario.Runner owns the execution order. Chain-specific behavior is kept in
the EVM, Gno, Union, and Voyager adapters. All external commands pass through
internal/process, allowing tests to replace them with deterministic fakes.

Execution flow

load and validate .env
  → verify the pinned union-voyager checkout
  → render and start an owned Voyager container
  → create or verify IBC clients
  → create or verify the connection and channel
  → execute enabled scenarios in registry order
  → save checkpoints and sanitized JSON evidence
  → clean up the owned Voyager container

• Without --apply, a fresh run performs read-only preflight.
• --apply enables broadcasts.
• --resume validates state.json against the current topology and continues
  without repeating completed writes.

IBC topology

The base scenario creates four underlying clients:

Host	Counterparty	Client type
Gno	Union	cometbls
Union	Gno	gno
Union	EVM	trusted/evm/mpt
EVM	Union	cometbls

It then creates the composed Gno ↔ EVM clients:

Host	Counterparty	Client type
Gno	EVM	state-lens/ics23/mpt
EVM	Gno	proof-lens

After verifying the client relationships and statuses, the runner establishes
the Gno ↔ EVM connection and the ucs03-zkgm-0 channel. Both sides' IDs,
ports, versions, counterparty fields, and OPEN state are checked.

Scenarios

Scenarios execute in the following order:

Flag	Behavior
--forged-proof-rejection	Mutates a real EVM membership proof, verifies rejection on Gno, then submits the original proof as a control.
--erc20-to-gno	Mints and approves ERC20, sends a TokenOrder, then verifies acknowledgements, commitment removal, balances, and refunds.
--amount-boundaries	Verifies int64 maximum, maximum-plus-one refund, and cumulative overflow behavior.
--gno-to-evm	Verifies wrapped-token initialize, escrow, unescrow, and invalid-quote refund flows.

--amount-boundaries and --gno-to-evm require a successful
--erc20-to-gno scenario.

Checkpoint and resume behavior

state.json stores the environment identity, topology IDs, failed-work
baseline, and packet progress.

Handshake and packet writes are checkpointed as *-submitting and
*-submitted. If a previous write cannot be identified unambiguously, resume
fails instead of broadcasting it again. Connection and channel resumes advance
only when matching external state is visible.

State and evidence files are written atomically with private permissions.
Evidence containing configured private keys or credential-bearing URLs is
rejected.

Supporting changes

• adds qeval-friendly Gno client/connection/channel queries;
• adds the admin-gated Gno E2E setup realm;
• adjusts oversized event-attribute splitting;
• adds the protected full-cycle GitHub Actions workflow;
• documents environment preparation and runner usage.

[aronpark1007]

channel-e2e-artifacts-20260804-164209/bin/gnokey (~36.8MB ELF binary) looks like a stray local artifact accidentally committed on this branch. .gitignore now covers this pattern going forward, but the existing blob should be dropped (git rm + rebase/squash) before this merges into main.

[notJoon]

channel-e2e-artifacts-20260804-164209/bin/gnokey (~36.8MB ELF binary) looks like a stray local artifact accidentally committed on this branch. .gitignore now covers this pattern going forward, but the existing blob should be dropped (git rm + rebase/squash) before this merges into main.

@aronpark1007 thanks for checking. I just dropped that file in this commit 91d091b