feat(planner): default seid logging.level to error, user-overridable

[bdchatham]

What

logging.level was controller-forced to error — applyForcedOverrides logged-and-discarded any user value. This makes error a default instead: commonOverrides seeds logging.level=error, and mergeOverrides already lets a spec.Overrides entry win. So the fleet default stays quiet, but an operator can set a different level per node via the CRD:

spec:
  overrides:
    logging.level: info   # now honored; previously discarded

How

• commonOverrides seeds the default (user-overridable via the existing merge precedence).
• Removed applyForcedOverrides (its only job was forcing logging.level) + the now-unused controller-runtime import; renamed enforcedLoggingLevel → defaultLoggingLevel.
• Tests: commonOverrides now asserts the default is set; forced_overrides_test.go → logging_level_test.go verifies default-and-override, including the full-node config-apply path (default→error, user→user value).

Behavioral change to note for review

This relaxes an enforced constraint: operators can now opt a node into verbose logging (e.g. debug) that was previously blocked. Intended per request; flagging so the log-volume/perf tradeoff is a conscious call. No CRD schema change (uses the existing spec.overrides); no webhook/CEL enforced it either.

Ready for the standard controller cross-review (k8s + SRE).

Review caveats (xreview: systems-engineer + idiomatic-reviewer, both RATIFY)

• Takes effect at bootstrap, not runtime. config-apply is init/bootstrap-only; the Running-node update path patches only [p2p]. So a logging.level override lands when the node is (re)initialized, not on a live spec.Overrides edit. (Pre-existing behavior — the old forced error was likewise stamped once at init.)
• Follow-up (sei-config): validateLogging validates only logging.format, not logging.level — an invalid level (e.g. "verbose", empty, case-wrong "ERROR") now passes config-validate and crashloops seid at startup (the old forced-error masked this). Add a level enum check in sei-config so it's rejected at config-validate. Fails loud/fast; not a blocker for this PR.

[cursor]

PR Summary

Medium Risk
Relaxes a previously enforced fleet-wide log level cap, so per-node verbose logging can increase volume and node load; behavior change is limited to planner override merge with no CRD schema change.

Overview
logging.level is no longer controller-forced to error. The planner now seeds logging.level=error in commonOverrides and relies on existing mergeOverrides precedence so spec.overrides.logging.level is honored (e.g. debug, info).

Removed applyForcedOverrides (and the reject-and-log behavior), renamed enforcedLoggingLevel → defaultLoggingLevel, and dropped the unused controller-runtime import from planner.go.

Tests were reshaped: commonOverrides asserts the default; forced_overrides_test.go was replaced by logging_level_test.go, covering default merge, user wins, and full-node config-apply params for both default and user values.

^{Reviewed by Cursor Bugbot for commit 5054dfa. Bugbot is set up for automated code reviews on this repo. Configure here.}