refactor: consolidate CI and local dev orchestration (#108)

## Summary
- Extract shared bootstrap functions into `scripts/bootstrap-common.sh` (eliminates ~120 lines of duplicated forge/cast commands from e2e.yml)
- Create reusable `scripts/wait-for-service.sh` for health checks (replaces 60-line inline wait-for-stack)
- Merge dev and CI entrypoints into unified scripts branching on `CI` env var (delete `docker/ci-entrypoints/`)
- Replace 4 per-service CI Dockerfiles with parameterized `docker/Dockerfile.service-ci`
- Add `sync-tax-rates.mjs` to CI image builder stage
- Fix: CI now grants txnBot recenter access (was missing)
- Fix: txnBot funding parameterized (CI=10eth, local=1eth)
- Delete 5 obsolete migration docs and 4 DinD integration files

Net: -1540 lines removed

Closes #107

## Test plan
- [ ] E2E pipeline passes (bootstrap sources shared script, services use old images with commands override)
- [ ] build-ci-images pipeline builds all 4 services with unified Dockerfile
- [ ] Local dev stack boots via `./scripts/dev.sh start`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: openhands <openhands@all-hands.dev>
Reviewed-on: https://codeberg.org/johba/harb/pulls/108

VERSION_VALIDATION.md

@@ -124,28 +124,20 @@ export function useVersionCheck() {
 
 ### 5. CI/CD Validation
 
-**File:** `.github/workflows/validate-version.yml`
+**File:** `.woodpecker/release.yml` (version-check step)
 
-```yaml
-- name: Extract versions and validate
-  run: |
-    CONTRACT_VERSION=$(grep -oP 'VERSION\s*=\s*\K\d+' onchain/src/Kraiken.sol)
-    LIB_VERSION=$(grep -oP 'KRAIKEN_LIB_VERSION\s*=\s*\K\d+' kraiken-lib/src/version.ts)
-    COMPATIBLE=$(grep -oP 'COMPATIBLE_CONTRACT_VERSIONS\s*=\s*\[\K[^\]]+' kraiken-lib/src/version.ts)
-    
-    if echo ",$COMPATIBLE," | grep -q ",$CONTRACT_VERSION,"; then
-      echo "✓ Version sync validated"
-    else
-      exit 1
-    fi
-```
+The Woodpecker release pipeline validates version consistency on tagged releases. The `version-check` step:
+1. Builds kraiken-lib (including `sync-tax-rates.mjs`)
+2. Runs an inline Node.js script that:
+   - Extracts `VERSION` from `Kraiken.sol`
+   - Extracts `KRAIKEN_LIB_VERSION` and `COMPATIBLE_CONTRACT_VERSIONS` from `kraiken-lib/src/version.ts`
+   - Fails if contract VERSION differs from lib VERSION
+   - Fails if contract VERSION is not in COMPATIBLE_CONTRACT_VERSIONS
 
-**Triggered on:**
-- PRs touching `Kraiken.sol` or `version.ts`
-- Pushes to `master`/`main`
+**Triggered on:** tag events (releases)
 
 **Prevents:**
-- Merging incompatible versions
+- Releasing with incompatible versions
 - Deploying with stale kraiken-lib
 
 ## Workflows