[KaloyanTanev]

Replaces the jwt-init container from #520: the execution client now generates the Engine API secret in the jwt volume, which becomes tmpfs, so the secret is replaced once both clients were stopped. el-reth gets a one-line entrypoint because Reth does not create a missing secret, and cl-teku and cl-nimbus run as root so they can read it.

For the next release instructions: deployments that ran jwt-init must run docker compose down --remove-orphans and docker volume rm <project>_jwt before docker compose up -d, otherwise the old on-disk secret is kept.

The secret is rotated when:

• docker compose down and then docker compose down are run
• the execution and consensus clients are both stopped and started again
• the execution and consensus clients are both recreated, for example after a version bump of both
• the host reboots

It is kept when only one of the two is restarted or recreated, and on docker compose restart of both.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud