Serve real Gloas bids and envelopes from the auctioneer's existing submissions

[0w3n-d]

Issue: #489 (step 6 of 6, per the reordering in #514)

What this PR does

• getExecutionPayloadBid now builds and signs a real SignedExecutionPayloadBid:
  it reads the winning submission out of ctx.payloads/bid_sorter (the same
  map get_header already reads), converts it via the prior step's
  to_lighthouse_gloas_payload/execution_requests_to_gloas, and signs under
  helix's own configured GloasBuilderIdentity -- no longer a permanent
  NoBidPrepared stub.
• submitSignedBeaconBlock's GloasPayloadStore/NoHeldPayloads placeholder is
  replaced by a real auctioneer round trip (Event::TakeHeldGloasPayload) that
  looks up the same payload by block hash and converts it for envelope
  construction.
• GloasBuilderIdentity is now constructed once in main.rs (from
  config.gloas_builder_index + the relay's signing keypair) and shared
  between the proposer API and the auctioneer, instead of being built
  separately inside ProposerApi::new.
• execution_payment is set equal to value (no payment-split product need
  yet -- see the resolved design note added to Gloas (ePBS) builder-API support #489).

What this PR deliberately does NOT do

• Does not enforce submitBuilderPreferences's max_execution_payment against
  the served bid -- still a known follow-up, unrelated to this step.
• Does not add a new builder-facing HTTP endpoint -- external builders keep
  submitting via the existing submit_block pipeline exactly as before; this
  PR only changes what happens to the winning submission when Gloas serves it.

Tests

Written before implementation, per this repo's workflow:

• check_execution_payload_bid_liveness keeps its 4 existing liveness tests
  (last one updated to expect Ok(()) now that a real bid follows).
• New build_signed_bid test: constructs a PayloadEntry, builds+signs a bid,
  checks every field maps from the entry/params/identity correctly, and
  verifies the BLS signature against the configured identity.
• construct_signed_envelope's 5 existing tests updated for the new
  Option<HeldGloasPayload> signature (same coverage, same assertions).

Reviewer checklist

• CI (lint, unit-test) is green
• This PR matches the step it claims to be (see linked issue)
• Nothing surprising: no unexplained scope creep, no unrelated files
  touched, no obviously-wrong code the tests happen not to cover