node: nuke allow-custom-genesis + allow-genesis-update flags

Operator owns the chainset. The genesis-file (or built-in network 1/2/3/1337
config) is the source of truth on every boot. No 'is this a standard network
ID? then guard against custom genesis' branching, no 'stored hash differs?
then refuse to boot unless you set this other flag' guard. Decomplect both:

- Genesis hash check (node/node.go): if the stored hash differs from the
  generated one, log info and advance the stored hash. Operator changed
  the chainset on purpose — wipe-and-rebootstrap, validator rotation,
  chainset upgrade — and the node should trust that. The DB hash is a
  tag, not a lock.

- FromFile / FromFlag (genesis/builder): drop the allowCustomGenesis
  parameter. Caller-driven: if you pass a genesis file, we use it.
  Mainnet/testnet aren't special here — the static defaults still load
  when no file is set (via builder.GetConfig).

- Wire all the way out: flag definitions (config/flags.go, config/spec/flags.go),
  key constants (config/keys.go), Node.Config struct field (config/node/config.go),
  reader (config/config.go). Five layers, none of them earned their keep.

config/config.go

@@ -1115,9 +1115,6 @@ func getUpgradeConfig(v *viper.Viper, networkID uint32) (upgrade.Config, error)
 }
 
 func getGenesisData(v *viper.Viper, networkID uint32, stakingCfg *builder.StakingConfig, dataDir string) ([]byte, ids.ID, error) {
-	// Get allow-custom-genesis flag (defaults to true for development)
-	allowCustomGenesis := v.GetBool(AllowCustomGenesisKey)
-
 	// Handle automine mode genesis - dynamically generate genesis with the node's own credentials
 	if v.GetBool(DevModeKey) && !v.IsSet(GenesisFileKey) && !v.IsSet(GenesisFileContentKey) && !v.IsSet(GenesisDBKey) {
 		return getOrCreateAutomineGenesis(stakingCfg, dataDir)
@@ -1162,7 +1159,7 @@ func getGenesisData(v *viper.Viper, networkID uint32, stakingCfg *builder.Stakin
 	// try first loading genesis content directly from flag/env-var
 	if v.IsSet(GenesisFileContentKey) {
 		genesisData := v.GetString(GenesisFileContentKey)
-		return builder.FromFlag(networkID, genesisData, stakingCfg, allowCustomGenesis)
+		return builder.FromFlag(networkID, genesisData, stakingCfg)
 	}
 
 	// if content is not specified go for the file
@@ -1185,7 +1182,7 @@ func getGenesisData(v *viper.Viper, networkID uint32, stakingCfg *builder.Stakin
 			}
 		}
 		// No cache or invalid cache - build from file and cache the result
-		genesisBytes, xAssetID, err := builder.FromFile(networkID, genesisFileName, stakingCfg, allowCustomGenesis)
+		genesisBytes, xAssetID, err := builder.FromFile(networkID, genesisFileName, stakingCfg)
 		if err != nil {
 			return nil, ids.Empty, err
 		}
@@ -2170,7 +2167,6 @@ func GetNodeConfig(v *viper.Viper) (node.Config, error) {
 	if err != nil {
 		return node.Config{}, fmt.Errorf("unable to load genesis file: %w", err)
 	}
-	nodeConfig.AllowGenesisUpdate = v.GetBool(AllowGenesisUpdateKey)
 
 	// StateSync Configs
 	nodeConfig.StateSyncConfig, err = getStateSyncConfig(v)

config/flags.go

@@ -115,8 +115,6 @@ func addNodeFlags(fs *pflag.FlagSet) {
 	fs.String(GenesisDBKey, "", "Path to existing genesis database for replay. Cannot be used with genesis-file or genesis-file-content")
 	fs.String(GenesisDBTypeKey, "zapdb", "Database type to use for genesis database. Must be one of {pebbledb, zapdb}")
 	fs.Uint64(GenesisBlockLimitKey, 0, "Limit number of blocks to replay during genesis (0 = all blocks)")
-	fs.Bool(AllowCustomGenesisKey, true, "Allow custom genesis for mainnet/testnet (default: true for development, set false for production)")
-	fs.Bool(AllowGenesisUpdateKey, false, "Allow updating stored genesis hash when genesis changes (use for adding new primary network chains)")
 
 	// Upgrade
 	fs.String(UpgradeFileKey, "", fmt.Sprintf("Specifies an upgrade config file path. Ignored when running standard networks or if %s is specified",

config/keys.go

@@ -20,8 +20,6 @@ const (
 	GenesisDBKey                             = "genesis-db"
 	GenesisDBTypeKey                         = "genesis-db-type"
 	GenesisBlockLimitKey                     = "genesis-block-limit"
-	AllowCustomGenesisKey                    = "allow-custom-genesis"
-	AllowGenesisUpdateKey                    = "allow-genesis-update"
 	UpgradeFileKey                           = "upgrade-file"
 	UpgradeFileContentKey                    = "upgrade-file-content"
 	NetworkNameKey                           = "network-id"

config/node/config.go

@@ -168,9 +168,8 @@ type Config struct {
 	UpgradeConfig upgrade.Config `json:"upgradeConfig"`
 
 	// Genesis information
-	GenesisBytes       []byte `json:"-"`
-	XAssetID         ids.ID `json:"xAssetID"`
-	AllowGenesisUpdate bool   `json:"allowGenesisUpdate,omitempty"`
+	GenesisBytes []byte `json:"-"`
+	XAssetID     ids.ID `json:"xAssetID"`
 
 	// ID of the network this node should connect to
 	NetworkID uint32 `json:"networkID"`

config/spec/flags.go

@@ -131,13 +131,6 @@ func allFlags() []FlagSpec {
 			Description: "Limit number of blocks to replay during genesis (0 = all blocks)",
 			Category:    CategoryGenesis,
 		},
-		{
-			Key:         "allow-custom-genesis",
-			Type:        TypeBool,
-			Default:     true,
-			Description: "Allow custom genesis for mainnet/testnet (default: true for development, set false for production)",
-			Category:    CategoryGenesis,
-		},
 		{
 			Key:         "upgrade-file",
 			Type:        TypeString,