fix: enforce finalized block/certificate binding

[matthias-wright]

Addresses #329.

Changes:

• syncer store_finalization: reject the write if a different block already occupies the height (immutable archive can't replace, so fail-stop rather than form a half-updated stale-block/fresh-cert pair).
• syncer try_dispatch_blocks: verify stored block.digest() == finalization.proposal.payload before reporting a finalized block at an epoch boundary; halt dispatch on mismatch.
• finalizer: replace the epoch-boundary debug_assert! with a release-enforced check that fail-stops (cancels the node) before storing a finalized header.
• test: test_finalizer_rejects_block_certificate_digest_mismatch — a boundary block paired with a certificate over a different digest must cancel the finalizer instead of storing a misbound header.

[sebastian-osec]

This looks like it fixes the main #329 path in the syncer: store_finalization now refuses to store a finalization if a different block already exists at that height, and dispatch also checks finalization.proposal.payload == block.digest() before reporting the pair.

One small concern: the finalizer fallback check happens after the block has already been executed, forkchoice committed, finalized height notified, and the syncer acked. Since the check is meant to prevent a block/certificate mismatch, should it run before execute_block(...) instead?

The normal syncer path should now prevent this case, so I don’t think this is the original issue still being open. But as defense-in-depth, the finalizer should probably reject the mismatched pair before applying any state changes.

[matthias-wright]

Update(5f30f5d):

• Bind finalized block to certificate before executing it

[sebastian-osec]

This looks good to me now