cometbft: WS Upgrade matcher case-insensitive + ct_ensure_wasm + statesync-skip-if-data

Per cursor cosmos handoff. (1) Traefik WS router rule Headers(Upgrade,websocket) is
case-SENSITIVE -> clients sending 'Upgrade: WebSocket' (python websocket-client) fall
through to the RPC router (200/400 not 101). rpc-client.yml now emits
HeadersRegexp(Upgrade,(?i)websocket) for all split-WS chains; regenerated cosmos+avalanche.
(2) Refactor into cometbft-common.sh: ct_configure_statesync skips if data/application.db
exists; new ct_ensure_wasm seeds CosmWasm/IBC-08 wasm (statesync omits them). init.sh calls
both. README documents wasm/version/WS gotchas. 45 other split-WS composes get HeadersRegexp
on their next regen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/README.cometbft.md

@@ -95,3 +95,22 @@ cosmos:
   are idempotent and don't clobber a synced datadir.
 - Migrating an existing problem chain (haqq/sei/zero-gravity/berachain) onto this base is a
   deliberate, separate step — diff the rendered compose + re-test live before trusting it.
+
+## CosmWasm / version gotchas (learned on cosmos-hub, 2026-06-16)
+- **Match the binary version to the live chain.** Cosmos chains hard-fork via governance; an old
+  binary panics `upgrade handler is missing for vX.Y.Z` (or halts at the upgrade height). Check the
+  live version: `curl <rpc>/abci_info | jq .result.response.version`. NOTE ghcr `tags/list` can LAG /
+  omit the newest tag — verify pullability with a direct manifest HEAD, not the tag list.
+- **state-sync does NOT restore CosmWasm + IBC 08-wasm files.** A wasm chain then panics at startup
+  (`wasmlckeeper failed initialize pinned codes / Error opening Wasm file`). Two fixes, both wired into
+  the lib: `ct_configure_statesync` skips if `data/application.db` already exists (idempotent restart),
+  and `ct_ensure_wasm <home> <url>` seeds a wasm-only snapshot (polkachu `*_wasmonly.tar.lz4`) when the
+  wasm dir is empty. Set `wasm_snapshot_url` in context for any CosmWasm chain.
+- **Fresh bootstrap of a wasm chain: prefer the FULL polkachu snapshot** over state-sync —
+  `https://snapshots.polkachu.com/snapshots/<chain>/<chain>_<HEIGHT>.tar.lz4` includes everything
+  (state + `wasm/` + `data/08-light-client/`). state-sync + `ct_ensure_wasm` is the lighter path but
+  the wasm extract paths/timing are best-effort.
+- **Traefik WS rule must be case-insensitive**: use `HeadersRegexp('Upgrade','(?i)websocket')`, NOT
+  `Headers('Upgrade','websocket')` — the latter is case-sensitive and clients sending `Upgrade: WebSocket`
+  (e.g. python websocket-client) fall through to the RPC router (200/400 instead of a 101 upgrade).
+  Driven by `client_ws_path`; the shared rpc-client.yml emits the regexp form for all split-WS chains.