op-conductor-ops: release single-file executables for op-toolbox

[jelias2]

Packages op-conductor-ops as a single-file PyInstaller executable per platform, published as GitHub release assets on an op-conductor-ops/v* tag push, so it can be installed via op-toolbox (catalog entry lands separately in infrastructure-services).

Today the tool requires a Poetry checkout and Python 3.12. After this, operators get one self-contained binary with no host Python.

What's here

• op-conductor-ops/entrypoint.py — freezable entry script (cli.py uses relative imports, so it can't be frozen directly)
• pyinstaller dev dependency + just build-binary VERSION PLATFORM recipe, so the CI build is reproducible locally
• .github/workflows/release-op-conductor-ops.yaml — builds darwin-arm64, darwin-amd64, linux-amd64, linux-arm64 natively (PyInstaller can't cross-compile); on a tag, assembles a checksums file and creates the release
• op-conductor-ops/Dockerfile — poetry install --only main so the new build dep does not ship in the published image
• README install paths; design doc + implementation plan under docs/superpowers/

Version is derived entirely from the tag (op-conductor-ops/v0.2.0 → assets named op-conductor-ops-0.2.0-<platform>). Asset and checksum naming mirrors netchef so op-toolbox's existing pattern substitution works with no Go changes.

Verification

The workflow runs on PRs touching op-conductor-ops/** precisely so all four platform builds are exercised before any tag is pushed — workflow_dispatch only works once the file is on main. Please confirm the four build legs pass here before this merges; the runner labels macos-15-intel and ubuntu-22.04-arm are the main unknown. Locally, the darwin-arm64 binary is 15MB and runs --help at exit 0.

Notes for reviewers

• .github/workflows/ is owned by @ethereum-optimism/cloud-security, hence the review request. Actions are SHA-pinned, jobs are least-privilege, checkout uses persist-credentials: false, Poetry is pinned to 2.3.4 (the version that generated the lock).
• Linux binaries build on Ubuntu 22.04, so they need glibc 2.35+; musl/Alpine is unsupported. Documented in the spec.
• Consciously deferred, happy to add if you want them: build provenance attestation (sibling workflows have it), --notes-start-tag (auto notes will otherwise diff against an unrelated proxyd/v* tag), and a --version flag on the CLI (op-toolbox renames the asset to bare op-conductor-ops, so the build isn't identifiable at runtime).
• pyinstaller carries a python = ">=3.12,<3.14" marker because no release spans the project's full ^3.12 range. The workflow's setup-python 3.12 pin is therefore load-bearing — on 3.14 Poetry silently skips it.

Follow-ups, both gated on this merging: tag op-conductor-ops/v0.2.0 to cut the first release, then add the op-toolbox catalog entry with the released checksums.