op-node: execute NUT bundles at Karst fork activation

[maurelian]

Introduces Network Upgrade Transactions (NUTs) for the Karst fork, encapsulated in a JSON bundle.

The changes are made in two commits:

1. feat(op-node): execute NUT bundles at Karst fork activation

• Adds the Karst fork (between Jovian and Interop) across rollup config, chain spec, batch validation, and sequencer
• Wires NUT bundle execution into PreparePayloadAttributes — bundles are embedded via go:embed and parsed at fork activation
• Allocates upgrade gas to the block gas limit so upgrade transactions aren't constrained by the system tx gas limit
• Adds UpgradeTransactionsFromNUTBundle as a generic helper for any fork to use
• Karst bundle is currently an empty placeholder

2. feat: add NUT bundle fork lock with CI check

• Adds op-core/nuts/fork_lock.toml to lock finalized bundles by sha256 hash
• Adds ops/scripts/check-nut-locks/main.go CI check (follows check-op-geth-version pattern)
• Adds CircleCI job + workflow entry and Makefile target

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.5%. Comparing base (42f6e3b) to head (eb7b6a6).
⚠️ Report is 4 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #19220      +/-   ##
===========================================
+ Coverage     75.2%    76.5%    +1.3%     
===========================================
  Files          193      729     +536     
  Lines        11225    81341   +70116     
===========================================
+ Hits          8443    62242   +53799     
- Misses        2638    18955   +16317     
  Partials       144      144              

Flag	Coverage Δ
cannon-go-tests-64	66.4% <ø> (ø)
contracts-bedrock-tests	79.9% <ø> (-0.2%)	⬇️
unit	76.7% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 539 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[wiz-inc-a178a98b5d]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[sebastianst]

LGTM!
The nut test fails because of just not recognizing the [script] tag yet. I suggest we just bump the mise just version, my local just supports it already without --unstable, am on 1.46.0.

[maurelian]

LGTM! The nut test fails because of just not recognizing the [script] tag yet. I suggest we just bump the mise just version, my local just supports it already without --unstable, am on 1.46.0.

@sebastianst I'm just seeing this comment. For now I've addressed this by using go run in CI rather than the just command. 2ed628c