fix(archiver): reject checkpoints that repeat a tx hash

[spalladino]

A checkpoint that repeats a tx hash from an earlier block could permanently corrupt that block in the archiver. Now, we validate that and throw. This stalls the syncing process until a prune comes along.

Context

Tx effects are stored keyed by tx hash alone, and the last write wins. A backup (escape-hatch) checkpoint is stored without being executed, so it can list a tx hash already included in an earlier, proven block. The later block then takes over the tx-effect row. When the later checkpoint is pruned, deleting it also deletes that row. The proven block below it can then no longer be loaded, and the node never fetches it again.

Approach

• The archiver now refuses to ingest such a checkpoint, and the whole addCheckpoints batch is aborted:
  • validateCheckpointStructure rejects a tx hash that appears more than once within a checkpoint;
  • the block store throws DuplicateTxHashError when a tx hash already belongs to a lower block that is still stored.
• Repeats at the same or a higher height are accepted. Honest flows produce them: a losing local proposal replaced by the L1 checkpoint, a checkpoint presented again after an L1 reorg, and promotion of a proposed checkpoint. The check relies on the updater removing replaced local blocks (and their tx-effect rows) before inserting the checkpoint.
• A repeated tx hash makes the checkpoint unprovable, because the same hash means the same kernel output and so duplicate nullifiers. Sync therefore stalls only until L1 prunes the checkpoint:
  • fix(archiver): restore the L1 sync point when a checkpoint batch fails #336 restores the L1 sync point when a batch fails;
  • the sequencer's cannot-build fallback runs before checkSync, so a proposer sends prune() even when its archiver is stuck;
  • after the prune, processCheckpointProposedLogs drops the stale CheckpointProposed log because archiveAt no longer matches.
• Docs: the archiver README and the comment at the archiveAt check now describe this recovery path. I also corrected two sequencer comments that said the build-start gate runs after checkSync.
• The existing test "fully cleans up blocks sharing a tx effect" built exactly the state the store now refuses, so it was rewritten to check the rejection and the cleanup of the ancestor block.
• Cost: one extra tx-effect read per tx when a block is inserted.

Fixes A-2181