fix(enm): revert disablePod on stale-beacon silent no-op [audit finding 1, HIGH]

[0xpanicError]

Finding 1 (HIGH) — disablePod silent no-op

EtherFiNodesManager.disablePod calls IEtherFiNode(node).disablePod(), which returns nothing. If the EtherFiNode beacon has not been upgraded yet, the old implementation's empty fallback() swallows the call and returns success — so the manager emits a false PodDisabled while the pod is still live. The runbook's next step (consolidating validators out) would then cut the pod's beacon-chain slashing factor and devalue our claim on the ETH still in it.

Fix

After calling disablePod(), assert the pod actually reports restakingDisabled(); otherwise revert PodNotDisabled. A stale-beacon deployment now fails loudly instead of silently succeeding.

Tests

• New regression test test_disablePod_revertsWhenPodNotActuallyDisabled (pod stays enabled → reverts PodNotDisabled).
• Updated test_disabledPod_retirementRoutesThroughTheNodeAsPodOwner to mock restakingDisabled() == true for the happy path.
• non-eigenpod-credentials suite: 77 passing on mainnet fork.

Evidence

Empirically reproduced on a Tenderly fork carrying real EigenLayer v1.14.0 (rehearsal test T2): pre-fix, disablePod silently succeeds + emits PodDisabled while restakingDisabled stays 0.

Base: pankaj/feat/non-eigenpod-withdrawal-credentials (fix targets code introduced by PR #485).

🤖 Generated with Claude Code

---

Note

High Risk
Touches irreversible EigenPod retirement on the restaking path; a wrong check could block legitimate retirements or still allow a false success that devalues ETH claims via the beacon slashing factor.

Overview
Fixes a HIGH audit finding where disablePod could silently succeed and emit PodDisabled even though the EigenPod was still live.

If the EtherFiNode beacon is stale, the empty fallback swallows disablePod() and returns success. The manager now asserts the pod exists and reports restakingDisabled() before emitting, otherwise reverts PodNotDisabled. That stops the runbook from consolidating validators out of a still-active pod and cutting the beacon-chain slashing factor.

Adds a regression test for the silent no-op path and updates the happy-path test to mock restakingDisabled() == true.

^{Reviewed by Cursor Bugbot for commit 7f7fa64. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[pankajjagtapp]

lgtm