fix(cosmic-swingset): enforce consensusMode, not by sniffing $DEBUG

[michaelfig]

closes: #4506
refs: #4510

Description

Decouple consensus mode from the $DEBUG variable. Instead, always enable for actual chain, and always disable for sim-chain.

Security Considerations

Better protection of our validator community.

Documentation Considerations

Testing Considerations

[mhofman]

I believe #2519 talks about being able to spin up a node that would capture vat console info, and thus would run outside of consensus mode. It seems with this change it's no longer possible to have this node be a simple follower node in non-consensus mode without patching the code, is that right?

[mhofman]

This looks fine by me, and easy to update when we need to have non-validating node that generate extra debug info.

[michaelfig]

I believe #2519 talks about being able to spin up a node that would capture vat console info, and thus would run outside of consensus mode. It seems with this change it's no longer possible to have this node be a simple follower node in non-consensus mode without patching the code, is that right?

That's correct. Do note that if you have a follower node (based on current Cosmos SDK), it will abort with CONSENSUS FAILURE even if you turn off this consensusMode flag. We can't have it both ways, simply because any vat behaviour that is outside of consensus will eventually manifest as a divergence in the behaviour that is tracked within consensus.

OTOH, #4510 outlines a way to have a vat-replay-tool, which would disable consensusMode but not worry about divergences.