feat(peers): automated weekly peers.txt + addrbook.json refresh

[rootulp]

Closes #526

What

Adds a weekly GitHub Actions workflow that refreshes peers.txt and addrbook.json for mainnet (celestia/) and mocha-4 (mocha-4/), plus the small Go tool and shell script it relies on.

How it works

1. Fetch + filter (scripts/peers/fetch-filter.sh): pulls the public Cumulo peer feed and selects tcp_verified peers, sorted by score.
2. Independently verify (scripts/peers/verifypeer, Go): dials each candidate, performs the CometBFT secret-connection handshake, and keeps a peer only if its authenticated node ID matches the claimed id@. An open port advertised under a mismatched ID is dropped and surfaced loudly (possible-poisoning signal). Cumulo is treated as a candidate source, not a trusted authority.
3. Regenerate addrbook.json from the verified peers.txt using the released celestia-appd addrbook subcommand.
4. Open a PR (peter-evans/create-pull-request) for human review. The job never pushes directly to master.

Runs weekly (Mondays 00:00 UTC) and on manual workflow_dispatch.

Scope / safety

• seeds.txt is intentionally left untouched — those are curated first-party DNS bootstrap seeds, which should stay stable rather than churn from a live peer feed. Only peers.txt + addrbook.json are auto-updated (add-paths enforces this).
• Sanity gate: requires ≥5 verified peers per network (else the leg fails and opens no PR); high-churn diffs get a high-churn label; any node-ID mismatches are listed in the PR body.

Validation

Pipeline run end-to-end against live data before opening this PR:

Network	Candidates	Verified (ID-matched)	ID mismatches
mainnet	20	6	0
mocha-4	20	8	0

addrbook.json generation confirmed with celestia-appd v8.0.3.

Notes

• The verifypeer module pins the Celestia fork of CometBFT (celestiaorg/celestia-core) so the handshake matches Celestia's p2p protocol.
• setup-go reads go-version-file from the module's go.mod so the Go version always matches the code.

🤖 Generated with Claude Code