fix(hermes): make wallet backup portable on k3d

[bussyjd]

Summary

Fixes the rc6 wallet portability failure on Linux k3d stacks:

• obol agent wallet backup now falls back to reading the remote-signer keystore through the k3d server node when the host-side PVC path is not readable by the CLI user.
• obol agent wallet restore now accepts a raw Ethereum V3 keystore as an input format and converts it into the existing Obol v1 backup envelope before writing runtime metadata.
• Adds regression coverage for both leaked rc6 behaviors.

Why

The rc6 reset path tells testers to preserve wallets before purging. On Linux k3d, the wallet file lives in a container-owned local-path volume, so direct host reads can fail with permission denied. The restore side also rejected the raw Ethereum V3 keystore users could manually extract from the container because restore only accepted the Obol v1 backup envelope.

Backup path

flowchart TD
    A[obol agent wallet backup] --> B[Read wallet metadata]
    B --> C[Read host-side keystore path]
    C -->|ok| D[Build Obol v1 backup]
    C -->|permission denied on k3d| E[docker exec k3d server]
    E --> F[cat mapped /data keystore]
    F --> D
    D --> G[Optional AES-GCM encryption]
    G --> H[Write backup file]

Loading

The fallback is intentionally narrow: it only runs for permission errors on k3d. Other read failures still surface directly.

Restore path

sequenceDiagram
    participant User
    participant CLI as obol CLI
    participant Backup as Backup decoder
    participant Geth as Ethereum keystore decoder
    participant Disk as Hermes deploy files

    User->>CLI: restore --input wallet.json
    CLI->>Backup: Decode Obol v1 envelope
    alt Obol v1 backup
        Backup-->>CLI: wallet metadata + keystore
    else Raw Ethereum V3 keystore
        Backup-->>CLI: unsupported version 3
        CLI->>Geth: decrypt raw V3 keystore
        Geth-->>CLI: address + public key + uuid
        CLI->>CLI: synthesize Obol v1 wallet payload
    end
    CLI->>Disk: write keystore, wallet metadata, remote-signer values

Loading

Raw V3 support does not change the persisted backup format. It is accepted only as an import-compatible restore input.

Validation

• go test ./internal/hermes -run 'TestBackupWalletCmd_K3dPermissionFallbackReadsFromNode|TestRestoreWalletCmd_HermesAcceptsRawEthereumV3Keystore|TestBackupRestoreWalletCmd_HermesRoundTrip|TestRestoreWalletCmd_HermesRequiresForceForExistingWallet' -count=1
• go test ./cmd/obol ./internal/hermes ./internal/walletbackup -count=1
• git diff --check
• Live CLI sanity against a running k3d stack: obol agent wallet backup obol-agent --passphrase <redacted> --output /tmp/obol-agent-wallet-backup-test.enc