perf(e2e): seed standard contracts at genesis

[spalladino]

Round-4 e2e speedup, PR 1b (adoption half of the AuthRegistry prize).

Stacked on #24567 (spl/genesis-prefilled-nullifiers, the genesis-nullifier mechanism). This PR targets that branch; retarget to merge-train/spartan-v5 once #24567 merges.

What

Make e2e environments start with the standard contracts (AuthRegistry, PublicChecks, HandshakeRegistry) already "published", so ensureAuthRegistryPublished and its two siblings skip their two publish txs each. At production cadence setup:auth-registry alone was ~16 min/run (2 sequential txs per process, paid per-process across the suite). This collapses that span to sub-second.

Mechanism (three parts, all default-off outside e2e)

• Genesis nullifiers. Per standard contract, seed siloNullifier(ContractClassRegistry, classId) and siloNullifier(ContractInstanceRegistry, instanceAddress) (the real derived address — standard contracts are not magic-address protocol contracts) into the fixtures' getGenesisValues call, via PR 1a's new 5th param. These are exactly the nullifiers the publish txs would emit, so the AVM's deployment-nullifier check passes when the contracts are called publicly. A single helper (getStandardContractGenesisNullifiers) feeds all four e2e genesis builders (fixtures/setup.ts, e2e_prover_test.ts, p2p/p2p_network.ts, multi-node/governance/add_rollup.test.ts) — the latter three recompute a genesis that must reproduce the L1-deployed archive root, so they must seed the identical set. Non-e2e callers (cli, sandbox/local-network) are untouched.

• Archiver preload. registerStandardContracts mirrors registerProtocolContracts: it seeds each contract's class (with recomputed publicBytecodeCommitment), instance, and public-function signatures into the contract store at block 0, reading the bundled @aztec/standard-contracts artifacts. It is idempotent (skips already-registered classes on restart) and gated behind a new archiver config flag testPreloadStandardContracts (env TEST_PRELOAD_STANDARD_CONTRACTS, default false). The flag is set from the e2e node config so every spawned node (validators, prover nodes) picks it up through the normal config path. This adds @aztec/standard-contracts as an archiver dependency.

• Guard short-circuit. The ensure*Published helpers are unchanged. Their guards read wallet.getContractClassMetadata(id).isContractClassPubliclyRegistered (to aztecNode.getContractClass) and wallet.getContractMetadata(addr).isContractPublished (to aztecNode.getContract) — both are archiver-store reads, not nullifier-tree reads. The store preload alone makes both short-circuit; the genesis nullifiers are what make the contract actually callable in the AVM afterwards. Keeping the helpers doubles as a regression check: if seeding ever breaks, the tx path re-engages and tests still pass, just slow.

Why the flag is test-only (A-1257 rationale)

Preloading unconditionally in production would recreate the A-1257 collision #24254 fixed: a real on-chain publish of a preloaded class would collide with the block-0 preload, because production genesis will not carry the matching nullifiers. The flag is only set by the e2e fixtures, which also seed the nullifiers, keeping the store and the nullifier tree consistent. A single source of truth (getPublishableStandardContracts) drives both the preloaded set and the seeded-nullifier set so they cannot drift.

State-write verification

Inspected the two publish txs on this base:

• ContractClassRegistry.publish pushes one nullifier (classId, siloed to the class-registry address) and broadcasts a ContractClassPublished contract-class log carrying the packed bytecode. No public-data writes.
• ContractInstanceRegistry.publish_for_public_execution asserts the class-registration nullifier exists, then pushes one nullifier (address, siloed to the instance-registry address) and broadcasts a ContractInstancePublished private log. No public-data writes.

So the full state-write set is two nullifiers + two broadcast logs. The nullifiers are replicated via genesis prefilledNullifiers; the archiver normally learns the class/instance from those two logs (data_store_updater.ts), and the block-0 preload replaces that path exactly. No genesisPublicData is required. PXE-side registration (wallet.registerContract) is unaffected and still runs in the helpers.

Local verification

• automine/accounts/authwit.test.ts (public-authwit path against the standard AuthRegistry), timing on: passes; setup:auth-registry span = 10 ms (was ~33 s at production cadence). No on-chain AuthRegistry publish (the only ContractClassRegistry.publish executions are the test's own AuthWitTest/GenericProxy deploys); the public AuthRegistry contract executes fine against the seeded nullifier. testPreloadStandardContracts: true confirmed in the node config dump.
• single-node/fees/account_init.test.ts (production sequencer + simulated prover node), timing on: 5/5 pass; setup:auth-registry span = 10 ms. Prover node syncs against the seeded genesis (no root divergence), and the flag propagates to it. No duplicate-nullifier errors.
• New unit test in archiver/src/modules/data_store_updater.test.ts: registerStandardContracts preloads each publishable standard contract's class + instance into the store and is idempotent on a second call.

Expected impact

~14–16 min/run from auth-registry alone, plus more from the two untagged siblings (PublicChecks / HandshakeRegistry) wherever used.

Measured impact

setup:auth-registry collapses from 702.2s of setup time run-wide (39 occurrences, 5–35s each) to
482ms total (max 87ms per occurrence) — sub-second run-wide, every shard clean, no seeding or
flag-propagation slow path.

• The measured beforeHooks reduction is larger than the auth-registry span alone, because the two
  untagged sibling publishes (PublicChecks, HandshakeRegistry) are removed too. Example: account_init
  beforeHooks −49.6s vs a 30.9s tagged auth-registry span; the extra ~19s is the two siblings.
• Per-suite beforeHooks deltas: account_init −49.6s, fee_settings −49.5s, failures −48.7s,
  private_payments.parallel −41.8s/shard (×8), gas_estimation.parallel −41.5s/shard (×3),
  l1_to_l2 −38.1s, l2_to_l1 −37.5s, l1_to_l2_inbox_drift −38.2s, token_bridge −37.7s,
  fee_juice_payments −37.4s, bot −34.3s; automine/parallel suites shed 5–15s each (their
  fast-cadence publishes).
• Total beforeHooks reduction over the suites present in both runs: −1,649.7s summed across shards
  (wall-clock benefit is smaller, since shards run in parallel across workers).

Baseline CI run 1783389062016888 (#24567 ci/x-fast; mechanism-only, so timing-neutral vs
merge-base). PR CI run 1783391194852197 (#24568 ci/x-fast).

Notes for downstream

• PR 6 (fees harness): applyEnsureAuthRegistryPublished now short-circuits; the fees setup chain loses the ~32 s/shard auth-registry step, so rebase the overlap/batch shape onto what remains (token deploy, FPC, mints).
• Fix phase / timing capture: expected span assertion is setup:auth-registry around sub-second across the run (10 ms observed locally per process). Any shard still showing tens of seconds means the guards took the slow path (a seeding or flag-propagation bug), not noise.

Fixes A-1404