haqq: drop truncated dteam peer, stop feeding the Polkachu addrbook JSON to ct_merge_seeds; cometbft-common: validate peer entries

- haqq/scripts/init.sh: 7c153a83@peer.haqq.mainnet.dteam.tech:28656 is not a 40-hex node id;
  haqqd refuses to start with it in seeds/persistent_peers. Removed from both defaults.
- haqq/scripts/init.sh: ct_merge_seeds was given ADDRBOOK_URL (a JSON addrbook, hundreds of KB)
  as the official seed list; the resulting sed argument exceeded ARG_MAX on Alpine. The
  addrbook is already installed by ct_set_addrbook; pass no seeds URL.
- scripts/cometbft-common.sh (+ per-chain copies via update.sh sync): ct_valid_peers filters
  seeds and persistent_peers to <40-hex>@host:port and logs what it drops, so a bad upstream
  entry can never block startup again.

Replaces the runtime override /root/onsite-overrides/haqq-mainnet-skip-addrbook-as-seeds.yml
that the onsite agent left on rpc-de-31 on 2026-09-07.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX

tac/scripts/cometbft-common.sh

@@ -68,11 +68,28 @@ ct_merge_seeds() {
       ct_log "no official seeds fetched from $_url (continuing with configured)"
     fi
   fi
+  _seeds=$(ct_valid_peers "$_seeds")
   if [ -n "$_seeds" ]; then
     sed -i "s/^seeds = \".*\"/seeds = \"${_seeds}\"/" "$_cfg"
   fi
 }
 
+# ct_valid_peers LIST
+#   Keep only well-formed CometBFT peer entries (<40-hex node id>@<host>:<port>), drop and
+#   log the rest. A truncated id such as 7c153a83@peer.haqq.mainnet.dteam.tech:28656 makes
+#   haqqd refuse to start ("invalid node ID"), 2026-09-07 rpc-de-31.
+ct_valid_peers() {
+  _in="$1"; _out=""
+  for _p in $(echo "$_in" | tr ',' ' '); do
+    if echo "$_p" | grep -Eqi '^[0-9a-f]{40}@[^@,:]+:[0-9]+$'; then
+      _out="${_out:+$_out,}$_p"
+    else
+      ct_log "dropping malformed peer entry: $_p"
+    fi
+  done
+  echo "$_out"
+}
+
 # ct_set_persistent_peers CONFIG_TOML PEERS
 #   Handles both cometbft-classic `persistent_peers` (underscore) and forks that use
 #   `persistent-peers` (hyphen, e.g. sei) — patches whichever key is present.
@@ -80,6 +97,8 @@ ct_set_persistent_peers() {
   _cfg="$1"; _peers="$2"
   [ -f "$_cfg" ] || return 0
   [ -n "$_peers" ] || return 0
+  _peers=$(ct_valid_peers "$_peers")
+  [ -n "$_peers" ] || return 0
   sed -i "s/^persistent_peers = \".*\"/persistent_peers = \"${_peers}\"/" "$_cfg"
   sed -i "s/^persistent-peers = \".*\"/persistent-peers = \"${_peers}\"/" "$_cfg"
   return 0