test: Add verification and rolling upgrade test for Rust launcher localnet

[barakeinav1]

Background

The Rust launcher (PR #2326) replaces the Python launcher for running MPC nodes in TDX CVMs. The localnet deployment scripts (PR #2563) support deploying with the Rust launcher, but there are no automated verification or upgrade tests.

We need a test script that validates the deployed cluster and tests the rolling upgrade flow (vote new MPC hash → restart CVMs → verify network).

User Story

As a developer testing the Rust launcher on localnet, I want automated verification and upgrade tests so I can quickly validate the cluster is working correctly and that the upgrade flow works end-to-end.

Acceptance Criteria

• Scenario 1 — Verify cluster: Script checks:

  • Contract state is Running
  • Signature generation works (ECDSA)
  • TEE accounts are registered (count matches N)
  • All attestations are real Dstack (not Mock)
  • Allowed image hashes are listed

• Scenario 2 — Rolling upgrade:

  • 2.1: Vote for a new MPC image hash on-chain (all threshold nodes vote)
  • 2.2: Wait for nodes to detect the new approved hash (written to /mnt/shared/image-digest.bin)
  • 2.3: Restart CVMs with updated TOML config pointing to the new image tag
  • 2.4: Verify network is fully operational with the new image (state, attestation, signatures)

Resources & Additional Notes

• Depends on PR chore: port node launcher to a rust binary #2326 (Rust launcher) and PR chore: Update localnet TEE script for Rust launcher #2563 (localnet scripts)
• Script reuses env variables from set-localnet-env.sh
• Uses vmm-cli.py update-user-config to update TOML on stopped CVMs, then restart