fix(wraith): the coordinator roster converges — no local verdicts, no first-look freeze (#710)

[defenwycke]

Part of #710. The first of two changes that ship in one release; the second spreads coordinator load evenly across every opted-in node.

What was measured

The night all eight mainnet nodes opted in (#708, epoch 6711), the rosters read 6/7/5/5/2/2/4/5 and the fleet elected two different coordinators for one epoch (vm1–3 → vm3, vm4–8 → vm5). Three checks over 25 minutes returned identical numbers. Ten hours later (09-11 08:35 UTC) there were still five distinct rosters. Only vm6 held all eight, and vm8 still elected a different coordinator from everyone else.

Two causes

1. The view was frozen at first look. refresh_for_height computed the roster once, when the epoch changed, and held it for the rest of the epoch (~a day). The roster was whatever the peer table held at that instant. vm8 restarted at 23:22 during the #708 rollout, while vm1–3 still had coordinating switched off. Ten hours later its roster was missing exactly vm1, vm2 and vm3. This was the dominant cause, and the measurements match it node for node.

2. Eligibility read a local verdict. qualified and archive came from QualifiedCapabilityProvider, which reads this node's own verification ledger: the challenges it issued and the verdicts it holds. Challenge rotation samples a few peers per round, so no two nodes hold the same evidence. That input cannot converge, however long you wait. The module doc called it "a qualification verdict the network reached together", and it was not.

What changes

• The roster is re-read on every refresh, and the view is rebuilt when the roster or an endpoint changes. The beacon and the seat target stay frozen for the epoch, so session-counter churn can't resize seats mid-epoch. A change is logged once (Coordinator roster changed, with the commitment), so a split can be traced to the moment it happened.
• qualified and archive are removed from NodeFacts, not defaulted off, so nobody can wire a local verdict back in without it showing up in review. Eligibility is now: opted in, dialable endpoint, 24h maturity, not absent for 7 days. Everything is declared by the node and gossiped.
• A lost seat is served until the epoch turns. A roster that can move mid-epoch can unseat a node while it holds rounds with committed inputs, and stop() aborts them. should_serve keeps the coordinator running for the rest of that epoch, and new wallets follow the current view.

⚠ What is given up

A Sybil cost. Before this change an identity needed a verified archive to coordinate. Now it needs its identity proof-of-work, a day of maturity and an endpoint. That's weaker, and the module says so. It wasn't load-bearing for safety: a coordinator can deny service but can't take coins, because the round is atomic and blind-signed whichever node runs it. Misbehaviour is handled by the outpoint ban list, and identity by the coordinator challenge (#881/#882). A verdict may come back only if every node reads the same one (BFT-finalised or chain-anchored).

Verification

• 8 new tests in coordinator_election, 19/19 pass. The headline test, a_node_that_drew_early_converges_on_the_late_nodes_election, reproduces the vm8 case: a node that drew from a partial roster ends up with the same commitment, beacon and seating as one that drew from the full roster.
• Mutations, run by hand. Restoring the freeze fails 5 tests, including the headline. Removing the drain rule fails both drain tests.
• scripts/mutate-wraith.sh targeted the removed archive rule and now targets the opt-in refusal: 29/29 caught.
• cargo fmt --check, the CI clippy invocation and cargo doc with -D warnings are all clean for both crates.

Rolling it

• No height gate. The election is not consensus and does not feed payouts (the +4 weight move is still unbuilt, L2 removal: capability reweight, the CapabilityType wire hazard, and what it reclaims #736 step 4).
• During the roll, nodes on the old binary keep their frozen rosters until they're restarted onto this one. That's the same split as today, not a new one.
• After the roll, compare roster_commitment across all eight (GET /api/v1/pool/coordinator on :8080). This binary is the first to publish it. Equal everywhere means converged. A node that restarts should match the others within a few health pings, not at the next epoch.

Not in this PR

• Load spread. At zero demand, one seat carries all four denominations for a day. That's the next PR.
• A brand-new node counts itself as mature from its first second, while peers wait 24h, so for its first day its own roster can differ. It's transient and pre-existing.
• roster_snapshot::lagged_snapshot_height has no callers. Left alone.