fix: prevent geth re-init on restart and harden compose defaults

[crazywriter1]

Summary

Fixes several reliability issues that can break node operation on restart or misconfigure data paths.

• geth entrypoint: Run geth init only when chaindata does not exist yet, with an explicit --datadir. Previously, init ran on every container start and failed on restart when a datadir was already present (set -e would exit the container).
• Compose env defaults: Move CLIENT and DATA_DIR defaults into docker-compose.yaml (${CLIENT:-reth}, ${DATA_DIR:-./reth_data}). The previous .env used shell interpolation (${CLIENT:-reth}, ./${CLIENT}_data) which Docker Compose does not expand reliably inside .env files.
• JWT generator: Use [ ! -s ... ] instead of [ ! -f ... ] so an empty JWT file is regenerated, not treated as valid.
• reth entrypoint: Read --max-outbound-peers from GETH_MAXPEERS instead of hardcoding 100.

Notes on rollup halt

rollup.halt is an op-geth flag (GETH_ROLLUP_HALT). op-reth v1.11.0 does not expose an equivalent CLI flag.

For reth deployments, protocol-version halt is enforced by op-node via OP_NODE_ROLLUP_HALT (already configured in .env.sepolia).

Test plan

Automated (./scripts/test-package-a.sh):

• docker-compose.yaml parses as valid YAML
• .env has no shell-default interpolation
• Compose defaults: CLIENT=reth, DATA_DIR=./reth_data
• JWT generator regenerates empty/missing secrets (-s)
• geth init only on fresh datadir; skipped when chaindata exists
• reth reads GETH_MAXPEERS (50) and defaults to 100
• docker compose config succeeds
• Volume bind: reth_data → /app/data
• JWT generator container creates 64-byte secret in Docker volume

Not run (source build is 30–60 min; out of scope for entrypoint/config fix):

• docker compose build
• docker compose up (requires build + L1 RPC)

geth usage

When switching to geth, pass both variables explicitly:

CLIENT=geth DATA_DIR=./geth_data docker compose up -d