feat(devnet): migrate from op-node to base-consensus

[danyalprout]

Description

• Setup base consensus on the local devnet
• Make several fixes to dockerfiles / setup

just devnet-status
./etc/scripts/devnet/status.sh

Component    | Unsafe     | Safe
-------------+------------+-----------
L1           | 25         | -
L2 Builder   | 39         | 25
L2 Client    | 39         | 25
L2 Ingress   | not running | -

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 2/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[github-actions]

Review Summary

This PR migrates the devnet from op-node to base-consensus for both builder-cl and client-cl services, adds a new Dockerfile.consensus, simplifies the enclave Dockerfile by removing cargo-chef, and makes several infrastructure improvements across Dockerfiles.

No new issues found. The changes are straightforward and consistent with existing patterns in the codebase:

• Dockerfile.consensus: Follows the same structure as other Rust Dockerfiles (builder, client, proposer, etc.). PROFILE handling with the dev -> debug directory mapping is consistent across all Dockerfiles.
• Dockerfile.enclave simplification: Removing cargo-chef in favor of BuildKit mount caches is a valid approach. The cp to copy the binary out of the cache mount before it's unmounted is correctly handled.
• docker-compose.yml: The CLI flag migration from op-node to base-consensus looks correct. The builder-cl correctly specifies --mode Sequencer, and the client-cl omits --mode which defaults to Validator — appropriate for a follower node. The --p2p.advertise.ip accepts hostnames via resolve_host() in crates/client/cli/src/p2p.rs, so passing Docker service names is valid.
• Enode ID update: Both devnet/src/setup/container.rs and etc/docker/devnet-env are updated to the same new value (3255458e...), keeping them in sync.
• useradd -m across Dockerfiles: Adding -m (create home directory) to all runtime images is a reasonable fix — some programs expect $HOME to exist.
• CI no-std change: Removing +stable from cargo invocation is safe since rust-toolchain.toml pins to 1.93.1 (stable).
• setup-l1.sh: Extracting .config from the genesis JSON via jq to produce chain-config.json is correct for the --l1-config-file flag that base-consensus expects.

Note: Previous inline review comments from an earlier run appear to be stale (e.g., flagging a jq install in Dockerfile.consensus that doesn't exist, and an enode ID mismatch that was actually fixed in this PR).

[refcell]

Amazing ty