feat(zeam): flip --chain-worker default to on (c-2c part 2 burn-in)

[zclawz]

Per @ch4r10t33r's call after the c-2b/c-2c merge (blockblaz/zeam#828): turn the chain-worker on by default in the deployed config so the burn-in actually exercises the prod path.

What

File	Before	After
client-cmds/zeam-cmd.sh	ZEAM_CHAIN_WORKER:- (default empty → no flag)	ZEAM_CHAIN_WORKER-on (default on)
ansible/roles/zeam/defaults/main.yml	zeam_chain_worker: ""	zeam_chain_worker: "on"

The shell side uses ${VAR-on} (no colon) deliberately: the colon form would also overwrite an explicitly-empty ZEAM_CHAIN_WORKER= with on, leaving operators no way to suppress the flag against older zeam builds. The non-colon form lets ZEAM_CHAIN_WORKER= (explicit empty) emit no flag — useful as an escape hatch.

Override behavior (all four cases)

# 1. Default — emits --chain-worker on (the prod path post-c-2b)
unset ZEAM_CHAIN_WORKER && ./spin-node.sh
# 2. Kill-switch — emits --chain-worker off (legacy synchronous path)
export ZEAM_CHAIN_WORKER=off
# 3. Suppress entirely (older zeam without the flag) — emits nothing
export ZEAM_CHAIN_WORKER=
# 4. Invalid value — WARN logged, no flag emitted
export ZEAM_CHAIN_WORKER=hello

Ansible side mirrors:

# 1. Default
ansible-playbook ... # picks up zeam_chain_worker: "on"
# 2. Kill-switch
ansible-playbook ... -e zeam_chain_worker=off
# 3. Suppress (against older image)
ansible-playbook ... -e zeam_chain_worker=

Required image

This PR REQUIRES blockblaz/zeam:devnet4 >= v0.4.14 (the c-2b release). Older images (v0.4.13 / pre-c-1) do not recognise --chain-worker at all and will fail to start; if you need to deploy this PR against an older image, the ZEAM_CHAIN_WORKER= / zeam_chain_worker: "" escape hatch suppresses the flag entirely.

(v0.4.14's --chain-worker is a presence-only bool — simargs sets it to true and ignores any value token. So --chain-worker on works as "enable", and --chain-worker off would ALSO enable, treating off as a stray positional. If you need the kill-switch, use the ZEAM_CHAIN_WORKER= empty form to suppress the flag entirely on v0.4.14. A future zeam release with a value-taking enum would let --chain-worker off actually disable.)

Burn-in target (per zeam #803 c-2c plan)

• ≥24h with --chain-worker on
• Watch zeam_lock_hold_seconds{lock="states", site="onBlock.commit"} p99 — should drop dramatically vs slice (b) baseline (rwlock no longer load-bearing under chain-worker single-writer regime).
• Watch lean_chain_state_refcount_distribution — typical=1, occasional 2-4, never >16 (entries stuck >16 indicate a leaked reader acquire).
• Watch lean_chain_queue_dropped_total — should be 0 under nominal load; non-zero means producer/consumer mismatch worth investigating.

Validation

$ bash -n client-cmds/zeam-cmd.sh && echo OK
OK

# unset env  → emits `--chain-worker on` ✅
# =off       → emits `--chain-worker off` ✅
# =''        → emits no `--chain-worker` flag ✅
# =hello     → WARN logged, no flag emitted ✅

[ch4r10t33r]

Looks good.