feat(tee)!: pin the summit genesis via config_digest; deliver it through tdx-init

tee/README.md

@@ -29,8 +29,8 @@ for its [InitConfig](https://github.com/SeismicSystems/enclave/blob/seismic/crat
   never provisions; it consumes a descriptor of an already-running node.
   VHD upload to the Azure image registry is a seismic-images concern
   (`make push-azure-*`), not this tool.
-- **For `seismic-tee-network genesis-ceremony`:** the `genesis` binary (built from
-  summit) on PATH. (The summit genesis template defaults to the
+- **For `seismic-tee-network genesis-ceremony`:** the `summit` binary on
+  PATH (its `genesis` subcommands). (The summit genesis defaults to the
   artifact-set copy beside `--manifest`.)
 - **For `seismic-tee-network up`** (cohort provisioning): the `pulumi`
   CLI on PATH. The `seismic_node` project pins ephemeral bootstrap stacks to
@@ -131,11 +131,12 @@ uv run seismic-tee-node configure --node /tmp/node.json \
 dials it on startup, and tdx-init derives the `root_key` fetch peer from it
 (`http://<host>:7878`) — one list, so the two can't skew. The `--manifest`
 is the network identity doc you're given for the network you're joining; it
-pins the `network_id`. The reth genesis JSON is POSTed alongside it (from
-`--reth-genesis`, defaulting to `reth-genesis.json` beside the manifest —
-the artifact-set layout); tdx-init writes it for reth's `--chain`. You
-never run `seismic-tee-network` — that's Seismic-internal network
-creation.
+pins the `network_id`. The reth and summit genesis files are POSTed
+alongside it (from `--reth-genesis`/`--summit-genesis`, defaulting to
+`reth-genesis.json`/`summit-genesis.toml` beside the manifest — the
+artifact-set layout); tdx-init writes them for reth's `--chain` and
+summit's `--genesis-path`. You never run `seismic-tee-network` — that's
+Seismic-internal network creation.
 
 ### Creating a new network (genesis ceremony)
 
@@ -152,23 +153,23 @@ template identity that can also found a throwaway test devnet (see
 #    and publish it + its measurements. This tool does not build.
 
 # 1. Create the network directory: `init` scaffolds the three authored
-#    inputs (reth genesis, summit template, measurements) under inputs/;
+#    inputs (reth genesis, summit genesis params, measurements) under inputs/;
 #    you edit them; then `assemble --dir` derives the artifact set
-#    (manifest, injected genesis, filled template, promoted policy) into
-#    the directory's top level. Everything top-level is hash-pinned by the
-#    manifest; everything under inputs/ is provenance. Edits go to the
-#    *inputs* + re-assemble — the manifest itself is pure output, never
-#    hand-edited.
-#    Commit the directory for any network that matters: a fresh assemble
-#    mints a fresh genesis_nonce, so the same network_id can never be
-#    regenerated from the inputs — the directory is everything needed to
-#    (re)configure, join, or debug the network later. assemble needs
-#    `seismic-reth` on PATH for the offline genesis-hash gate.
+#    (manifest, injected genesis, completed summit genesis, promoted
+#    policy) into the directory's top level. Everything top-level is
+#    hash-pinned by the manifest; everything under inputs/ is provenance.
+#    Edits go to the *inputs* + re-assemble — the manifest itself is pure
+#    output, never hand-edited.
+#    Commit the directory for any network that matters: it is everything
+#    needed to (re)configure, join, or debug the network later, and its
+#    manifest is the network's immutable identity. assemble needs
+#    `seismic-reth` on PATH for the offline genesis-hash gate and `summit`
+#    for the genesis config digest.
 uv run seismic-tee-network manifest init tee/networks/devnet-3 \
     --reth-genesis ../seismic-reth/crates/seismic/chainspec/res/genesis/dev.json \
     --measurements ../seismic-images/build/measurements.json \
     --measurement-id seismic_2026-06-11.abc123.vhd
-#    → edit tee/networks/devnet-3/inputs/summit-genesis-template.toml
+#    → edit tee/networks/devnet-3/inputs/summit-genesis.toml
 #      (namespace, …)
 uv run seismic-tee-network manifest assemble tee/networks/devnet-3
 
@@ -202,7 +203,7 @@ uv run seismic-tee-network configure \
     --manifest tee/networks/devnet-3/network-manifest.json
 
 # 4. Run the genesis ceremony once: builds genesis.toml from the cohort
-#    (needs the `genesis` binary on PATH) and fans it out to every summit.
+#    (needs the `summit` binary on PATH) and fans it out to every summit.
 #    Waits for cohort readiness itself in two stages: each node's reth must
 #    serve the manifest's genesis hash as block 0, then every node's Summit
 #    pubkeys must be readable. `configure` normally waits for root-key bootstrap
@@ -213,9 +214,9 @@ uv run seismic-tee-network configure \
 #    while provisioning is active. Elapsed and remaining time are shown while
 #    waiting, and the command can run straight after step 3.
 #    One-shot: send_genesis only exists in the pre-genesis node API, so this
-#    can never be re-run against a live network. --summit-template defaults
+#    can never be re-run against a live network. --summit-genesis defaults
 #    to the artifact-set copy beside --manifest (verified against the
-#    manifest's summit.genesis_template_hash); --node defaults to the
+#    manifest's summit.genesis_config_digest); --node defaults to the
 #    descriptors in the nodes/ dir beside it.
 uv run seismic-tee-network genesis-ceremony \
     --manifest tee/networks/devnet-3/network-manifest.json