fix: bind checkpoint consensus keys to the verified terminal header

[matthias-wright]

Builds on #423 (which builds on #422 and #402).

Addresses #217.

Changes:

• Step 3 now accumulates a node-key to BLS-key map and requires each checkpoint account's consensus_public_key to equal the BLS key accumulated for that node from the verified history. Mismatch returns the new CheckpointConsensusKeyMismatch error variant. The reverse membership check uses the same map.
• Add test_checkpoint_verifier_binds_consensus_keys_to_terminal_header covering both directions: the honest case (accounts carry the real, accumulated consensus keys and verify) and a swapped consensus key (rejected with CheckpointConsensusKeyMismatch). The shared checkpoint_verification_fixture gains a tamper_consensus_key parameter that swaps one active account's stored consensus key while leaving its node key, status, and the accumulated set intact.

[sebastian-osec]

I think this is a good partial fix for the current active-validator key-swap case, but I think there is still a bypass for validators that are queued to join.

The new check binds validator_accounts[node_key].consensus_public_key to the accumulated BLS key only for validators in the current signing set. A Joining validator is not in that signing set yet, so its account key is not checked against the verified added_validators[next_epoch] entry.

That matters because epoch activation later loads the account by node key and only changes:

account.status = ValidatorStatus::Active;

It does not overwrite account.consensus_public_key from the verified AddedValidator.consensus_key.

So a malicious checkpoint can make added_validators[next_epoch] match the terminal header, while setting the corresponding joining account’s consensus_public_key to a different BLS key. Verification accepts it, and when the validator activates, the attacker-chosen account key becomes active.

I think the verifier should also enforce:

validator_accounts[added.node_key].consensus_public_key == added.consensus_key

for every validator in added_validators[next_epoch].

[matthias-wright]

Update(bfc4fc9):

• Bind checkpoint consensus keys to the verified terminal header

[sebastian-osec]

This looks good to me now.