fix(consensus): validate block retrieval responses - #798

Summary

• reject successful block-retrieval responses that carry an empty block batch
• validate zero-block-id epoch retrieval responses instead of skipping response.verify()
• restore retrieved LedgerInfo signature / epoch checks while allowing the known epoch-change suffix block-number mismatch
• return errors instead of panicking on malformed retrieval batches or block/QC mismatches during catch-up

Why

gravity-sdk#793 temporarily disabled retrieved LedgerInfo verification to avoid rejecting valid epoch-change suffix responses. That also removed the signature check and left malformed successful responses able to reach expect / assert sites in catch-up. This PR keeps the epoch-boundary compatibility while restoring the network-facing validation and making the consumer path fail with errors instead of panics.

Tests

• cargo +nightly fmt --all -- --check
• RUSTFLAGS="--cfg tokio_unstable -D warnings" cargo check -p "path+file:///Users/lightman/repos/gravity-sdk/aptos-core/consensus#aptos-consensus@0.1.0" --lib
• RUSTFLAGS="--cfg tokio_unstable" cargo test -p "path+file:///Users/lightman/repos/gravity-sdk/aptos-core/consensus/consensus-types#aptos-consensus-types@0.1.0" verify_rejects_empty_successful_response
• git diff --cached --check

Audit coverage

• https://github.com/Galxe/gravity-audit/issues/954