Talos actions fix

[sparrowDom]

Problem

Every origin-dollar scheduled action in Talos prod has been failing with:

ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL  Command "tsx" not found

#2848 moved the action runtime off hardhat to tsx tasks/run.ts and rewrote all 46 schedule commands in migrations/seed_schedules.sql accordingly — but tsx was never declared. It is absent from contracts/package.json and from pnpm-lock.yaml, and the image installs with pnpm install --frozen-lockfile, so pnpm exec tsx fails in the runner container.

The same change added tasks/lib/network.ts and tasks/lib/signer.ts importing @talos/client. The package is published as @oplabs/talos-client (renamed in #2946, which landed the day before), and dockerfile-actions installs that name — so both modules fail to resolve in the image. No tsconfig path alias covers the old name.

Why CI stayed green

dockerfile-actions wraps the catalog dump in a swallow-all fallback:

pnpm exec tsx dump-actions-catalog.ts > /app/actions-catalog.json \
  || (echo "[build] action catalog dump failed; shipping empty catalog" \
      && echo "{}" > /app/actions-catalog.json)

tsx was already missing at build time, the dump failed, and the || branch shipped {} and let the build succeed. The runner logged loaded actions catalog: 0 tasks on boot. The build had the exact signal needed to catch this and discarded it.

Changes

• Declare tsx@^4.23.1 in dependencies — it is a genuine runtime dependency of the container now, not tooling, so it belongs there rather than devDependencies (survives any future --prod install).
• Point tasks/lib/{network,signer}.ts at @oplabs/talos-client.

Lockfile movement is tsx + its esbuild platform binaries only; no version changes to existing packages.

Verification

Reproduced the exact prod failure locally, then confirmed the fix:

	actions in catalog
before (prod image)	0
tsx added, stale import	15 (27 modules skipped: Cannot find module '@talos/client')
both fixes	42, zero skips

Cross-checked the catalog against the schedule table: all 46 scheduled rows reference 38 distinct actions, and every one resolves in the catalog.

pnpm run typecheck fails identically on master with and without this change (@types/node is undeclared) — pre-existing, left alone.

Follow-up (not in this PR)

The || echo "{}" fallback should fail the build, or at minimum fail when the dump yields {}. A fallback that turns a fundamentally broken image into a green build is why this reached production rather than CI.

[naddison36]

LGTM