chore: cut seictl v0.0.70 (seed per-source-IP connection cap)

[bdchatham]

Bumps sei-config to v0.0.25 and cuts seictl v0.0.70.

What this delivers

v0.0.25 sets the seed profile's max_incoming_connection_attempts to 32 — a cap on concurrent connections per source IP (conn_tracker.go:33-38), not attempt rate. It had been carrying the inherited 100 while the seed's max_connections is 1000, so one source could hold ~10% of a seed's inbound slots and ~10 addresses could fill it.

sidecar/tasks/config_apply.go is the sole renderer of node config, which makes this image the delivery vehicle. Verified end to end — DefaultForMode(ModeSeed) under v0.0.25 renders:

max-connections = 1000
max-incoming-connection-attempts = 32
allow-duplicate-ip = true

v0.0.25 also carries sei-config#42 (GigaExecutor in baseDefaults).

Delivery mechanics — read before rolling this out

TaskConfigApply runs on the init path only. An update plan carries only p2pConfigPatch (planner.go:787-796, and the convention is stated at planner.go:68-69 and :821). So putting this sidecar into a cell does not re-render config on already-running nodes — a sidecar bump restarts pods against unchanged on-disk config.

The seeds take the new default by being deleted and recreated, which forces the init path. Verified safe for a seed:

• their p2p Services carry no ownerReferences, so deleting the SeiNode does not cascade to the NLB — hostname and therefore the NodeID@host address survive;
• node_key.json is a read-only Secret mount (arctic-1-seed-N-node-key, mode 0400) overlaying whatever seid init writes, so the NodeID survives the PVC being recreated;
• the 20Gi PVC holds no chain state; the address book rebuilds via PEX.

Ordering matters: the cell's images.sidecar must already point at this image before a seed is recreated, or the new pod renders from the old sidecar and keeps 100.

Review

Full T3 shared-stack xreview: designs/seed-node-mode/xreview/sei-config-v0.0.25-rollout.md in bdchatham-designs (#130). It returned OPEN-BLOCKED against the original rollout plan; this PR is step 2 of the revised plan, which addresses both blockers.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Low code risk (dependency + version bump only), but medium rollout risk because P2P admission behavior on seeds changes once init re-renders config; ordering of image promotion vs. node recreation matters.

Overview
Release-only change: bumps github.com/sei-protocol/sei-config v0.0.24 → v0.0.25 and cuts seictl v0.0.70 (version.json, go.sum). No application code in this repo is modified.

The new dependency carries seed-mode defaults where max-incoming-connection-attempts is 32 (concurrent connections per source IP), down from the inherited 100 relative to max-connections 1000—so this image is how that P2P limit reaches nodes when the sidecar runs ConfigApply via sei-config.

Rollout is operational, not automatic on sidecar restart: config apply runs on the init path, so existing pods keep on-disk config until seeds (or other nodes) are recreated with the cell already pointing images.sidecar at v0.0.70.

^{Reviewed by Cursor Bugbot for commit 6953d44. Bugbot is set up for automated code reviews on this repo. Configure here.}