feat(epbs): prysm CL support in the ePBS sim + client-agnostic service discovery

Adds configs/epbs/gloas-epbs-prysm.yaml (prysm beacon-chain + validator images,
--enable-builder, supernode) and makes run-epbs-sim.sh discover the CL/VC services
dynamically (cl-1-* / vc-1-*) instead of hardcoding lodestar, so the loop runs for
any client. Prysm exposes the same keymanager builder_config endpoint, so cb-km
apply reuses unchanged.

Author: JasonVranek

configs/epbs/gloas-epbs-prysm.yaml

@@ -0,0 +1,49 @@
+# ePBS (gloas) devnet against a PRYSM CL/VC build (PR #17397, VC -> gloas builder API).
+# Same loop as gloas-epbs.yaml (VC -> keymanager builder_config -> commit-boost ->
+# buildoor) but with prysm instead of lodestar. Prysm exposes the same keymanager
+# POST /eth/v1/validator/{pubkey}/builder_config endpoint (validator/rpc
+# handlers_validator_config.go SetBuilderConfig), so `cb-km apply` reuses unchanged.
+# Prysm uses SEPARATE beacon-chain + validator images and needs --enable-builder on
+# the VC. Build from the PR branch with BOTH --config=release AND --config=minimal
+# (prysm's preset is COMPILE-TIME; a mainnet-built binary can't load a minimal genesis):
+#   git clone --branch builder-rest-vc https://github.com/OffchainLabs/prysm
+#   bazelisk build //cmd/beacon-chain:oci_image_tarball //cmd/validator:oci_image_tarball \
+#     --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64_cgo --config=release --config=minimal
+#   docker load -i bazel-bin/cmd/{beacon-chain,validator}/oci_image_tarball/tarball.tar
+# Then RE-TAG to a local-only name (the sim runs --image-download always, which would
+# otherwise pull the PUBLIC gcr.io/offchainlabs/prysm over your local build):
+#   docker tag gcr.io/offchainlabs/prysm/beacon-chain:latest local/prysm-beacon-chain:epbs
+#   docker tag gcr.io/offchainlabs/prysm/validator:latest    local/prysm-validator:epbs
+participants:
+  - el_type: geth
+    el_image: ethpandaops/geth:glamsterdam-devnet-8
+    cl_type: prysm
+    cl_image: local/prysm-beacon-chain:epbs
+    vc_image: local/prysm-validator:epbs
+    cl_log_level: debug
+    vc_log_level: debug
+    vc_extra_params:
+      - --enable-builder
+    # PeerDAS/Fulu requires a supernode (or a node with 128+ validators).
+    supernode: true
+    keymanager_enabled: true
+    validator_count: 64
+mev_type: buildoor
+buildoor_params:
+  image: ethpandaops/buildoor@sha256:501764a3c43e6289fa1b85df9e7489f1d2de24e1efe0a65c4d316bd340166991
+  builder_api: true
+  epbs_builder: true
+  lifecycle: true
+  extra_args:
+    - --log-level=debug
+network_params:
+  preset: minimal
+  seconds_per_slot: 6
+  gloas_fork_epoch: 0
+  attestation_due_bps_gloas: 2500
+  withdrawal_type: "0x01"
+  validator_balance: 32
+  builder_count: 1
+  builder_balance: 100
+  deploy_eip8282_contracts: true
+global_log_level: info

scripts/run-epbs-sim.sh

@@ -156,7 +156,7 @@ cb_logs() {
 # for the same reason as cb_logs: the rejection line lives in the full history,
 # not the 200-line tail (the tail hiding it was the sole cause of the earlier
 # "floor unexercised" flake).
-bn_logs() { kurtosis service logs -a "$ENCLAVE" cl-1-lodestar-geth 2>&1 || true; }
+bn_logs() { kurtosis service logs -a "$ENCLAVE" "$BN_SVC" 2>&1 || true; }
 
 # ---- keymanager helpers (used out-of-enclave, exactly like cb-km) -----------
 # Authenticated GET/POST of a validator's builder_config, against the same
@@ -494,9 +494,14 @@ log "launching gloas devnet ($ARGS_FILE)"
 kurtosis run "$EP_PACKAGE" --enclave "$ENCLAVE" --args-file "$ARGS_FILE" --image-download always
 
 NET="kt-${ENCLAVE}"
-BN="$(kurtosis port print "$ENCLAVE" cl-1-lodestar-geth http)"
-VC_KM="$(kurtosis port print "$ENCLAVE" vc-1-geth-lodestar http-validator)"
-[[ -n "$BN" && -n "$VC_KM" ]] || die "could not discover BN / VC keymanager ports"
+# Discover the CL/VC service names (client-agnostic: cl-1-<cl>-<el>, vc-1-<el>-<cl>),
+# so the loop works for lodestar, prysm, etc. without hardcoding the client.
+BN_SVC="$(kurtosis enclave inspect "$ENCLAVE" 2>/dev/null | grep -oE 'cl-1-[a-z0-9-]+' | head -1)"
+VC_SVC="$(kurtosis enclave inspect "$ENCLAVE" 2>/dev/null | grep -oE 'vc-1-[a-z0-9-]+' | head -1)"
+[[ -n "$BN_SVC" && -n "$VC_SVC" ]] || die "could not discover cl-1-* / vc-1-* services in $ENCLAVE"
+BN="$(kurtosis port print "$ENCLAVE" "$BN_SVC" http)"
+VC_KM="$(kurtosis port print "$ENCLAVE" "$VC_SVC" http-validator)"
+[[ -n "$BN" && -n "$VC_KM" ]] || die "could not discover BN / VC keymanager ports ($BN_SVC / $VC_SVC)"
 echo "BN=$BN  VC-km=$VC_KM  net=$NET"
 
 # ---- 2. wait for the beacon node + gloas activation -------------------------