feat: protect archive RPC resources

[ukint-vs]

Summary

• Pin local copies of sc-cli, sc-service, and sc-rpc-server from Polkadot SDK commit 298f676c91d64f15f38ea7fd78f125c5889ab09c, with provenance and license notices.
• Add repeatable --rpc-method-limit METHODS=CALLS_PER_MINUTE,MAX_IN_FLIGHT configuration. Alias groups share one node-wide rate/concurrency budget across HTTP, WebSocket, batches, and reconnects; exhausted calls fail immediately with JSON-RPC -32999.
• Add bounded method-limit metrics and opt-in rpc_calls=trace attribution without request parameters or response bodies.
• Reuse exact cached runtime versions before checking out or allocating a Wasm runtime instance.
• Forward optional repeated method-limit values through the Vara and generic Docker Compose templates without enabling a default limit.

Test Coverage

• cargo test --locked -p sc-executor runtime_version — 6 passed.
• cargo test --locked -p sc-rpc-server method_limit — 14 passed.
• cargo test --locked -p sc-cli rpc_method_limit — 4 passed.
• cargo check --locked -p sc-service — passed.
• cargo check --locked -p gear-cli --features vara-native — passed.
• make node — passed.
• Live HTTP batch smoke: state_getRuntimeVersion succeeded and its chain_getRuntimeVersion alias was rejected with -32999 under a shared 1,1 budget; trace output reported the canonical method, rate reason, and bounded in-flight values.

Pre-Landing Review

No blocking issues found after review fixes. One informational gap remains: cross-transport behavior has unit coverage and an HTTP smoke test, but no permanent real-network HTTP/WebSocket integration test.

Scope Drift

Scope check: clean. No budget values are hard-coded or enabled by default.

Plan Completion

Implementation and local verification are complete. Production measurement and rollout remain intentionally deferred because no disposable archive clone/snapshot or authorized canary endpoint was available, and the existing production/staging endpoints were unsafe for load generation.

Deferred operational checks:

• Select representative historical hash sets and capture baseline RPC, host, and executor metrics.
• Exercise alias and expensive-control RPC concurrency matrices on a disposable archive node.
• Derive production budgets from measured throughput rather than mean/max latency alone.
• Canary one archive node, verify live HTTP/WebSocket enforcement and observability, then observe normal traffic before rollout.

Documentation

• substrate/README.md records the pinned Polkadot SDK source commit and local adaptation policy.
• THIRD_PARTY_NOTICES.md records the copied crates and applicable licensing.

Test plan

• Executor cache hit/miss and cache-key behavior.
• CLI parsing, validation, and service propagation.
• Shared alias rate/concurrency admission, rejection, cancellation, metrics, and batch behavior.
• Service and Vara-native CLI checks.
• Full Gear node build.
• Live two-item HTTP batch smoke.
• Disposable archive-node baseline and canary validation (operational follow-up).

[ukint-vs]

@ukint-vs Replaced by #5638, which uses an upstream branch so CI can start without fork workflow approval.