chore(release): sync release/0.6.1 with main for v0.6.1 (#1034 + #1036)

[curryxbo]

Summary

Syncs release/0.6.1 with main ahead of tagging v0.6.1 — direct push is blocked by branch protection, so the two main squash commits are cherry-picked here verbatim:

1. fix: hardening fixes from code review (response body bound, RLP length guard, metrics port) #1034 audit hardening (db0b54c4) — oracle HTTP response body bound (1 MiB), RLP tx length uint32 overflow guard, layer1 metrics port range validation, beacon endpoint URL redaction in metrics/logs.
2. chore(deps): pin go-ethereum to released morph-v2.2.5 #1036 geth pin to released morph-v2.2.5 (3d21e1f4) — go.mod/go.sum in all 8 modules, Makefile target version, and go-ethereum submodule pointer all move to the commit tagged morph-v2.2.5.

After merging, release/0.6.1 matches main exactly; publish the v0.6.1 draft to tag.

Test plan

• Both commits already green on main
• All 8 modules build in workspace mode (CGO enabled); node/derivation and hermetic common/batch tests pass locally

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f3501993-d18b-4f80-b823-61b03c9e8e6f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}