device-health-oracle: update link.health and device.health

[nikw9944]

TODO: Review and update plan.

Modify the device-health-oracle to actively write health status to the blockchain (instead of just reading).

1. Go SDK enum overhaul (smartcontract/sdk/go/serviceability/state.go)

• Change Device/Link status enums from sequential iota to explicit values with gaps, matching the Rust smart contract. Remove Suspended/Deleted statuses, replace with Deleting. Reorder HardDrained/SoftDrained values for links.
• Start health enums with Unknown = 0 (new), shifting Pending to 1, etc.
• Change all String() methods from array indexing to switch statements (safer with non-sequential values).

2. Smart contract changes

• Device creation (create.rs): Start devices with DeviceHealth::Pending (was hardcoded to ReadyForUsers as a TODO workaround). Change default desired_status from Pending to Activated.
• Link creation (create.rs): Same pattern — start links with LinkHealth::Pending (was ReadyForService), change default desired_status to Activated.
• CLI authority display: Rename access_authority to sentinel_authority, add health_oracle field.

3. Device-health-oracle worker (the core change)

• Add new ServiceabilityExecutor interface with SetDeviceHealthBatch and SetLinkHealthBatch — enabling the oracle to write to the blockchain.
• Add signer keypair as a required flag, load at startup, and pass to the executor.
• Rewrite worker logic: on each tick, fetch all devices/links, find those in provisioning state with Pending/Unknown health, and batch-update their health to ReadyForUsers/ReadyForService (batches of 8, sized for Solana's 1232-byte tx
  limit).
• Add underflow protection for slot arithmetic on fresh environments.

4. E2E test infrastructure

• Pass the manager keypair to the device-health-oracle container as a signer.
• Add WaitForAllDevicesAndLinksActivated to main_test.go — polls until all devices/links reach activated/drained state.
• Update several tests (device_maxusers_rollover, link_onchain_allocation, multi_client, user_ban) to wait for the oracle to do its work.

5. Smart contract Rust tests (many files)

• Add an explicit SetDeviceHealth(ReadyForUsers) or SetLinkHealth(ReadyForService) step before asserting activated status in all tests that create devices/links and expect immediate activation — reflecting the new two-phase activation.

6. RFC + Changelog

• Update RFC12: change DeviceDesiredStatus enum values (remove Unknown/Deleted, renumber Drained).
• Add changelog entry for the device-health-oracle feature.

[nikw9944]

System Prompt

Update Branch

You are a Claude Code instance managed by Roadbike.
You are working on branch nikw/2669 in repository malbeclabs/doublezero for issue #2669.

Task

Integrate the latest changes from the main branch into your working branch and push the result.

Steps

1. Integrate changes from main:

   git fetch origin main
   

   Then decide the best integration strategy:
   • Rebase (git rebase origin/main) if the branch has a clean, linear history
     and has NOT been force-pushed or shared with others beyond this PR.
   • Merge (git merge origin/main) if the branch has already been pushed and
     has review comments or CI runs tied to specific commits.
     If there are conflicts, resolve them intelligently. If conflicts are too complex, report STATUS: BLOCKED.
2. Run the build/test suite to verify nothing is broken after the integration.
3. Push the updated branch: git push origin nikw/2669
4. If a PR already exists for this branch, it will be updated automatically.

Conflict Resolution

• If you can confidently resolve all conflicts, do so and continue.
• If the conflicts are too complex or ambiguous, report STATUS: BLOCKED with details about
  which files conflict and why you cannot resolve them.

Reporting Status

• STATUS: COMPLETE — Branch updated and pushed successfully.
• STATUS: BLOCKED — Merge conflicts that you cannot resolve. Describe the conflicts.
• STATUS: ERROR — Something went wrong.

File Operations

The Write and Edit tools should work for files matching your permission profile's
allowed paths. If you encounter a permission error when trying to use Write or Edit,
fall back to Bash commands for file creation and modification. The Read tool always
works normally.

Bash fallback for creating or overwriting a file:

cat > path/to/file << 'FILEEOF'
file content here
FILEEOF

Append to a file:

cat >> path/to/file << 'FILEEOF'
content to append
FILEEOF

Create a file in a new directory:

mkdir -p path/to/dir && cat > path/to/dir/file << 'FILEEOF'
file content here
FILEEOF

Edit part of a file (simple substitution):

sed -i '' 's/old_text/new_text/g' path/to/file

Edit part of a file (complex changes): Read the file with the Read tool, then rewrite
it entirely with cat >.

Quoting rules:

• Always single-quote the heredoc delimiter ('FILEEOF') to prevent shell variable
  expansion ($var, backticks, etc.) inside the file content.
• If your file content contains the literal string FILEEOF on its own line, use a
  different delimiter (e.g., 'INNEREOF').
• For sed, use different delimiters if the pattern contains / (e.g., sed -i '' 's|old|new|g').