test: journeys for node startup, Tor and I2P, the scripthash index toggle, and the CLI

[rearden-grok]

Section 9 of the journey-fold index: node CLI, tip mode, and startup. Four journeys and one crate test replace 56 package tests. Each journey drives the node the way an operator does and asserts what the operator sees.

Journey	Where	Replaces
node_listen_and_exit	cross_surface	10 run_p2p_* tests and startup_refuses_non_pruned_config_on_pruned_datadir
tor_control_onion_lifecycle	cross_surface	10 tor_control tests, i2p_accept_incoming_forwards_to_loopback, electrum_i2p_forward_when_sam_incoming
enter_tip_mode_indexes	cross_surface	6 enter_tip_mode_* tests
node_cli_and_surface_smoke (extended) plus node-crate operator_conf_and_argv	scenarios, cli.rs	19 cli.rs, 7 config.rs, and 1 rbitcoin-cli tests

node_listen_and_exit: one datadir, restarted through run_p2p while its one --connect peer refuses.

• A junk peers file and a missing asmap start an empty book. The saved book then records the refused peer.
• The next start loads that book and a valid ip_asn.dat. Esplora, Electrum, and RPC answer at genesis until stop.
• An Electrum port that another process holds only warns.
• Seeds with no --connect resolve none on regtest, and the node exits short of tip mode.
• After a --prune-seqsigwit start, an unpruned start refuses. That refuse now goes through run_p2p rather than apply_startup_index_mode.

tor_control_onion_lifecycle: run_p2p against a fake Tor control port and SAM bridge. Live Tor and i2pd stay in overlay-functional.

• A cookie from another Tor, a 2-byte cookie, and a Tor that offers only plain COOKIE each refuse the start without sending AUTHENTICATE.
• Password auth with --listen-onion, --i2p-accept-incoming, Electrum, and Esplora mints one onion key per service, saved 0600, and saves each SAM destination. It sends a STREAM FORWARD to each port, and getnetworkinfo.localaddresses lists every address.
• A SAFECOOKIE restart reuses the saved keys and destinations.
• The old tests called TorControl and I2pSam with no node behind them. Nothing checked the port run_p2p hands Tor, or that the address reaches RPC.

enter_tip_mode_indexes: --sh-index off, on, off, on across restarts of one datadir.

• Blocks mined with the index off are collected from Class A on the first start with it on.
• Turning the index off closes Electrum.
• After a crash leaves a collect run and a lagging include high-water mark, the durable index resumes under write-behind. The run is discarded, not merged, and the next block lands in history.
• This journey spawns run_p2p off the runtime workers, as cli_main does: an empty datadir connects genesis through tip-accept, which refuses a worker thread.

CLI: the smoke journey now owns every exit code and datadir effect.

• Usage errors exit 2 before a datadir is touched. That covers every concatenated, one-dash, and Core spelling.
• Conf refusals exit 2 and open no store.
• Validate refusals exit 1.
• One start takes the native flag set together, CLI --datadir wins over conf datadir, and --datadir-cold splits seqsigwit.
• rbitcoin-cli help and version do not dial.
• The values argv and the conf file assemble (defaults, the milestone anchor, listen ports, help text) are reported by no running surface. They stay as one node-crate test, operator_conf_and_argv, in place of the parse half of those tests. overlay_config is the precedent.

The TESTING.md catalog gains the three new rows and the extended smoke row. The external-findings regression pointers for 042 and 044 now name these journeys.

Not in this PR: the optional ibd_cancellable stop-during-catch-up beat from the index's coverage notes.

Local: fmt, clippy -D warnings, deny, ast-grep, and ci-os-smoke.sh are green, and so is the workspace suite except one pre-existing race outside this diff. rbitcoin-rpc addnode_two_nodes_see_each_other reads pong bytes the moment both peers show in getpeerinfo. It failed in two of three workspace runs, and passed 5/5 alone and on master. rbitcoin-net tip_burst_past_broadcast_capacity_still_syncs_peer missed its 10s wall once under load and passed alone.

🤖 Generated with Claude Code