feat: post-reconstruction signature verification with fallback (PR #890 split 3/4)

[shane-moore]

Context

Part 2 of the PR #890 split, per review comment. Depends on #932.

Scope

Core spec compliance (~250 LOC prod + ~400 LOC tests, 3 crates). Implements ReconstructSignature + FallBackAndVerifyEachSignature.

Files

File	Change
client/src/lib.rs	Pass database.clone() to signature collector (1 line)
validator_store/src/lib.rs	Add validator_pubkey to ValidatorSigningData (1 line)
signature_collector/Cargo.toml	Add metrics + database deps
signature_collector/src/lib.rs	try_combine_and_verify, verify_reconstructed_signature, find_invalid_shares, fetch_share_pubkeys; CombineOutcome enum; while loop retry; DB wiring through manager; SignatureCollecting trait
signature_collector/src/metrics.rs	SIGNATURE_VERIFICATION_FAILURES_TOTAL counter
signature_collector/src/tests.rs	Unit tests for find_invalid_shares, try_combine_and_verify; integration tests for happy path + fallback eviction/recovery

Key design decisions

• CombineOutcome enum for explicit control flow (Success / CombineFailed / VerificationFailed)
• while loop replaces if to retry after evicting invalid shares
• SignatureCollecting trait for testability
• spawn_blocking for DB access to avoid blocking async runtime

Known issue to address

• The while loop + eviction interaction when remaining shares still >= threshold needs review (flagged in original PR comment)

Parent issue

• Track PR #890 split: partial sig with fallback (4-PR stack) #931

[shane-moore]

Still live, re-verified at epbs 16b64b6: the inbound path performs no share verification (receive_partial_signature -> add_partial_signature, signature_collector/src/lib.rs:651-677), try_reconstruct combines the first threshold of shares unverified and caches the result (:679-704), and later shares for a completed collection are dropped (:656-658). The groundwork from #936 (get_share_pubkeys_for_validator) and #943 (the index) is merged but the helper's only callers are database tests, so one RSA-authenticated operator submitting a bad share still poisons any reconstruction. #932 and #940 look complete via those merged PRs, leaving this as the remaining live piece of the #931 split.

New consumer for this fix: the Early RANDAO SIP (ssvlabs/SIPs#101 at 01a14f1) adds a cross-client test vector requiring that an operator-authenticated share with an invalid BLS signature contributes to no reconstructed reveal and that reconstruction still succeeds from a valid threshold of honest shares. The reconstruct-then-verify-with-share-level-fallback design proposed here satisfies that vector as-is (eager per-share verification is not required). #1179 (early RANDAO producer) references this issue as the mitigation for cached early reconstructions.

[shane-moore]

closed via #1198