Update localnet deploy scripts for Rust launcher

[barakeinav1]

Summary

• Generate TOML config files instead of flat key=value .conf files to match the new Rust tee-launcher
• Update paths for tee_launcher/ → deployment/cvm-deployment/ move
• Add vote_add_launcher_hash phase (feat: vote on launcher image hash #2343)
• Add vote_add_os_measurement phase (docs: add OS measurement voting to TEE setup flows #2488)
• Add set-localnet-env.sh convenience script
• Update single-node.sh and documentation

Test plan

• Run deploy-tee-localnet.sh with MODE=localnet N=2 end-to-end
• Verify rendered .toml files match expected structure
• Verify launcher hash and measurement votes land on contract

🤖 Generated with Claude Code

[claude]

PR title type suggestion: This PR changes deployment scripts and configuration templates, which are maintenance/tooling changes. The type prefix should be chore: instead of starting with Update.

Suggested title: chore: update localnet deploy scripts for Rust launcher

[claude]

Code Review

This PR updates localnet deploy scripts for the Rust launcher: TOML config generation, path updates, and new voting phases. Overall the changes are straightforward and well-structured.

Issues found:

• ports_to_toml missing space after = (both deploy-tee-localnet.sh:160 and single-node.sh:144): The generated TOML looks like { host =8080, container =8080 } — asymmetric spacing (space=value instead of space = value). While technically valid TOML, this is cosmetically inconsistent and could cause confusion. Consider { host = $host_port, container = $container_port } for consistency.

• ports_to_toml duplicated across two scripts (deploy-tee-localnet.sh and single-node.sh): The function is identical in both files. If these scripts grow further, consider extracting shared helpers to a common sourced file. Not blocking, but worth noting.

• set-localnet-env.sh contains hardcoded user-specific values: MACHINE_IP=51.68.219.1 and BASE_PATH=/mnt/data/barak/dstack appear to be specific to one developer's environment. This file is meant as a convenience template, but having a specific developer's IP and path committed could be confusing. Consider using placeholder values (e.g., MACHINE_IP=<your-ip>) or adding a comment that these must be customized.

• extract_measurement_from_tcb_info uses printf with unsanitized jq output (deploy-tee-localnet.sh:~1135): The hex strings extracted by jq are interpolated directly into a JSON string via printf. If any field contained quotes or special characters, it would produce malformed JSON. Since these come from controlled tcb_info.json asset files (hex strings), the practical risk is low, but using jq -n to construct the JSON would be more robust:

  jq -n --arg mrtd "$mrtd" --arg rtmr0 "$rtmr0" --arg rtmr1 "$rtmr1" \
        --arg rtmr2 "$rtmr2" --arg kp "$kp_digest" \
    '{mrtd: $mrtd, rtmr0: $rtmr0, rtmr1: $rtmr1, rtmr2: $rtmr2, key_provider_event_digest: $kp}'

None of these are merge-blocking for a localnet deployment script. The logic is correct and the new voting phases are properly ordered.

✅ Approved — localnet-only script changes look correct. Minor suggestions above for robustness.