refactor(blockstream): add tips-only mode to avoid pulling blocks when not needed

[spalladino]

Motivation

Two of the four L2BlockStream consumers download every block payload only to discard it — the stream
needed the blocks solely so its reorg walk-back had local hashes to compare:

• prover-node: its handler ignores blocks-added entirely. Every block from the partially-proven epoch
  onward was downloaded at startup (via startingBlock), and every block at the tip thereafter, all unused
  — its checkpoint catch-up is cursor-driven since refactor(stdlib)!: thin chain-checkpointed event, collapse sync #24007.
• PXE (default syncChainTip: 'proposed'): used only the last header of each blocks-added batch to
  update its anchor, downloading the whole unfinalized range per sync to keep one header.

This PR introduces a tips-only stream mode so neither consumer downloads blocks it never uses.

Stacked on #24042, which hardens the block-mode walk-back and adds the pass-completion gate this PR's
chain-proposed emission relies on. The walk over sparse history additionally relies on #24042's
missing-local-hash rule (correctness) and finalized-tip walk floor (bounds the walk to the unproven
window).

Approach

• New thin chain-proposed event, emitted in both modes after the blocks, symmetric with the other
  tier events. A pass emits chain-pruned → blocks-added* → chain-proposed → chain-checkpointed → chain-proven → chain-finalized (tiers highest-to-lowest so the local tip-ordering invariant holds
  mid-pass). It fires iff the proposed tip changed during the pass, compared against the pre-pass local tip
  rather than the post-prune re-read — otherwise it would never fire on prune-then-download passes.
  Emission is gated on the pass-completion check from fix(stdlib): fix race conditions in L2BlockStream #24042, so a chain-proposed for an undelivered tip
  cannot corrupt block-mode tips cursors.
• tipsOnly mode: skips the download loop entirely (zero getBlocks calls, blocks-added never
  emitted). Reorg detection reuses the existing walk-back over sparse history: the tips store records one
  (number, hash) entry per tip-moving poll from chain-proposed, and the tier handlers' recorded tips
  densify it. Steady-state cost per poll drops to one getL2Tips plus at most one getBlockData.
• Witness registration keeps sparse-history prune targets honest. The walk-back rolls back to the
  nearest recorded hash at or below the true divergence, so a reorg landing inside a witness gap would
  produce an over-deep prune event (reporting more pruned blocks than were rolled back). A recorded hash
  is the only thing tying local per-height state to a specific fork, so consumers that materialize
  per-height state now record witnesses for those heights via the new
  L2TipsStoreBase.recordBlockHashes(blocks): hash-index writes only, no tip cursor moves, and a witness
  on an orphaned fork is compared rather than trusted (it fails the hash comparison and the walk continues),
  so the API cannot cause under-deep prunes. Where no witness covers a height, over-deep prunes remain the
  accepted fallback (idempotent checkpoint reprocessing; note re-sync).
• prover-node: consumes the stream in tipsOnly mode. The startingBlock resolution is deleted
  (computeStartupState → resolveLastFullyProvenEpoch), taking the prover-node out of the startingBlock
  hazard class entirely (p2p is now its sole user). Cursor seeding, at-least-once retry ordering, and the
  expiry ticker are unchanged. It records a witness for every block of each checkpoint it registers.
• prover-node prune handling re-keyed off the prune target. The chain-pruned handler used
  event.checkpointed.checkpoint — the source's current checkpointed tip, which sits above the prune
  target whenever the source re-checkpointed past the divergence before the prune was observed (a restart
  spanning a prune+rebuild, or a same-number checkpoint replacement seen atomically). Number-keyed marking
  then left orphaned provers canonical and under-clamped the catch-up cursor, permanently skipping a rebuilt
  checkpoint with the same number. It now keys off event.block (the highest surviving block):
  markPrunedAboveBlock marks every prover whose checkpoint holds a block above the target (no source
  fetch; catches partially-orphaned straddling checkpoints), and the cursor clamps to one below the
  target's checkpoint — over-clamping by one only re-registers a checkpoint (registration is at-least-once,
  A-1041), whereas under-clamping is the dangerous direction.
• PXE: consumes the stream in tipsOnly mode; anchors on the proposed tip by fetching the header by
  hash (reorg-safe — it can no longer anchor on a header from a stale batch). The handler now updates the
  tips store after consumer-side work, so a thrown anchor update or prune rollback is retried on the next
  sync instead of silently lost; a missing proposed header throws (node inconsistency) to keep the cursor
  retryable. It records a witness at the anchor height whenever the anchor advances — the rollback boundary
  for the note and private-event stores — keeping prune events at the true divergence.

API changes

Internal only (no RPC surface changes):

• L2BlockStreamEvent gains { type: 'chain-proposed'; block: L2BlockId }; all event switches updated.
• L2BlockStream gains the tipsOnly option; the constructor throws if it is combined with
  startingBlock, batchSize, or skipFinalized.
• L2TipsStoreBase (and the L2TipsStore type) gain recordBlockHashes(blocks: L2BlockId[]).
• CheckpointStore.markPrunedAfter(checkpointNumber) → markPrunedAboveBlock(blockNumber) (prover-node).
• TraceableL2BlockStream (telemetry-client) deleted — zero production users and a stale opts type.

Changes

• stdlib: chain-proposed event + emission (gated on the fix(stdlib): fix race conditions in L2BlockStream #24042 completion check); tipsOnly mode +
  constructor validation; handleChainProposed in the tips store base; recordBlockHashes witness API.
• stdlib (tests): tips-only suite (zero-getBlocks, sparse-history prunes, constructor validation),
  pre-pass baseline / block-mode chain-proposed, event ordering, sparse anchors vs finalized hash
  deletion, witness-tightened prune targets (with vs without a recorded witness). (The walk-back,
  prune-payload-freshness, re-read, and pass-atomicity regressions live in fix(stdlib): fix race conditions in L2BlockStream #24042.)
• prover-node: tipsOnly; startingBlock resolution deleted; handler arms updated; prune handling
  re-keyed off event.block (block-range marking + cursor clamp to cpAtTarget - 1, with prune-to-genesis
  and missing-target fallbacks); witness recording at checkpoint registration; tests adjusted, including a
  same-number checkpoint-replacement regression the old checkpoint-number keying fails.
• pxe: tipsOnly; by-hash proposed anchoring with throw-on-miss; handler ordering flipped to
  store-last (at-least-once); anchor-height witness recording; tests including a retry-after-throw
  red/green regression.
• p2p / world-state: no-op chain-proposed arms (world-state also gains an exhaustiveness default);
  block-mode behavior untouched.
• kv-store (tests): shared tips-store suite covers the new event and the witness API (records hashes,
  moves no cursors).

Fixes A-1209