opgeth-decoupling: audit op-devstack/sysgo direct ethclient calls (L1 vs L2)

Part of #20265 → #20257. See plan §13 (item 5) in the [op-geth decoupling doc](https://github.com/ethereum-optimism/optimism/blob/develop/docs/ai/opgeth-decoupling.md).

## Strategy

`op-devstack/sysgo` calls `ethclient.Dial` / `ethclient.NewClient` directly in a handful of files (re-derive with `grep -rln 'ethclient\.' op-devstack/sysgo/`). Audit each call site by target endpoint:

- L1 callers (contract deployment, dispute-game setup): safe under upstream go-ethereum — stay on `*ethclient.Client`.
- L2 callers: migrate to `op-service/sources.EthClient` / `apis.EthClient`.

## Acceptance criteria

- Every remaining `ethclient` use in sysgo is verifiably L1-only (short comment or PR-description note); all L2 paths go through sources.

🤖 *Generated by Claude Code*

Start with the plan in docs/ai/opgeth-decoupling.md §13 item 5, then run grep -rln 'ethclient\.' op-devstack/sysgo/ to locate every call site. Audit each target endpoint as L1 or L2: remaining ethclient uses must be verifiably L1-only, while L2 paths should use op-service/sources.EthClient or apis.EthClient.

Written by the indexing model from the issue text.