indexer: sponsored aggregate RegisterBlsKey for new signers

[wilfreddenton]

Note

Medium Risk
Changes the on-chain instruction/operation wire format and BLS aggregate verification/execution paths (including nonce handling and payer attribution), which could break compatibility and affect signature validation if any edge cases are missed.

Overview
Adds aggregate support for RegisterBlsKey, including sponsored registration for new signers via SignerClaim::PubKey, and moves replay protection into the aggregate envelope by requiring a per-op nonce in AggregateInfo.signers.

Refactors the instruction/op wire format: Inst/Op become { payment, kind } and { metadata, kind }, Payment is moved into OpMetadata (with a core-paid sentinel for Issuance), and aggregate signing messages now cover (SignerClaim, nonce, inst) instead of (signer_id, inst).

Updates aggregate verification to resolve SignerClaim to signer_id, verify RegisterBlsKey contributions against the inline bls_pubkey (and ensure signer_map is populated), advances nonces for all aggregate ops using the envelope nonce, and charges RegisterBlsKey via a registry.registered() contract call before writing the key.

^{Reviewed by Cursor Bugbot for commit edb8a15. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default mode and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3b43e8c. Configure here.}