fix(archiver): authenticate every Inbox message recovery anchor on L1

[spalladino]

Background

The archiver stores each L1-to-L2 Inbox message with its message index, cumulative rolling hash, and the L1 block
where the event was first observed. When its local message log disagrees with L1, recovery searches backward for a
recovery anchor: the newest stored message that L1 still contains at the same index and rolling hash. Recovery keeps
the prefix through that anchor, deletes the suffix, and resumes ingestion from around the anchor's L1 block. The
archiver also persists a finality marker from the last synchronization that successfully agreed with L1.

The problem

A message's stored L1 height does not change when the same event is re-mined elsewhere but the resulting Inbox
content remains identical. The old recovery path nevertheless treated a stored height at or below the finality
marker as proof that the message was final, without looking up its event.

The regression test demonstrates the resulting loop:

1. Two messages are first observed at L1 block 100, so both stored rows record block 100.
2. L1 re-mines the same messages at block 130 with the same indices, contents, and rolling hashes. The Inbox still
   agrees with the local log, so synchronization has no reason to refetch the rows; they continue to say block 100.
3. The persisted finality marker advances to block 120. The stored rows now appear to be below finality even though
   their actual events are at block 130, above the marker and still replaceable.
4. L1 replaces block 130 and inserts two different messages at the same indices.
5. Recovery examines the old messages. Because their recorded block 100 is at or below marker 120, the old shortcut
   accepts them without checking L1. It therefore retains both messages and effectively rolls the local count from
   two back to two.
6. Forward ingestion finds the replacements at block 130, but they begin at index zero and cannot be appended to
   the retained two-message prefix. Recovery starts again and selects the same false anchor.

The node stops making progress on Inbox message synchronization. The old implementation repeats this cycle until a
restart causes a cold search rather than reusing the false anchor.

What this changes

A stored L1 height is now only a search hint. Every recovery anchor, including a candidate recorded at or below the
persisted finality marker, must be authenticated by a bounded L1 event lookup that finds the same message index and
rolling hash.

In the example, neither old message can be found unchanged on L1. Recovery walks past both candidates, selects the
zero-message position, rewinds to the Inbox deployment block, and lets ordinary forward ingestion store the two
replacement messages. The regression test confirms that synchronization reaches L1 head 140 and exits recovery.

The existing lookup budget still limits work per synchronization pass, and lookups remain bounded above by the
captured L1 head. Rollback, message deletion, cursor movement, and pruning of proposed blocks that depend on the
removed suffix remain one store transaction.

What this does not do

This does not update a stored message's original L1 height when an unchanged event is re-mined. It removes the
assumption that the old height proves the event's current placement. The authenticated, monotonically advancing
finality marker remains synchronization metadata, but it no longer bypasses anchor authentication.

Recovery may now perform more backward event lookups and may require multiple passes when it exhausts the existing
per-pass budget. Conservative rollback can prune proposed blocks whose consumed messages appeared to be below the
finality marker; forward ingestion restores the canonical messages, but this change does not restore those proposed
blocks. No cache or additional persisted recovery state is introduced.

The captured-head bound, deployment-block fallback, and recovery behavior for unreadable or replaced L1 views are
unchanged.

Testing

The regression test covers messages first observed at block 100, re-mined unchanged at block 130, a finality marker
at 120, replacement at block 130, fallback to an empty anchor, forward refill, and successful exit from recovery.
Existing recovery tests now require an event lookup even for candidates recorded at or below the finality marker,
and continue to cover bounded searches and finding an authenticated common prefix.

These are fake-chain archiver tests. The diff does not add a live-provider reorg test or a performance benchmark for
the additional backward lookups.