fix(p2p): canonicalize yParity attestation signatures before L1 bundle

[spalladino]

Context

A committee member — or any peer mutating the recovery byte in flight — can emit an attestation signature in yParity form (v = 0/1) that still recovers to the same signer, since coordination-signature recovery allows yParity as v. This is enough to brick an honest proposer.

On the proposer side, CommitteeAttestationsAndSigners.packAttestations treated v === 0 as an empty (address-only) slot, while getSigners treats a signature as empty only when r, s, and v are all zero. The two disagree for a real signature with v = 0: the packed bitmap popcount excludes it but the signers array keeps it, so an honest proposer's propose() reverts on L1 with AttestationLib__SignersSizeMismatch. A v = 1 signature instead passes propose() but reverts epoch proving, where verifyAttestations runs ECDSA.recover and rejects v ∉ {27,28}. Either variant lets a single actor repeatably halt block production or proving for slots they attest to, with no slashing signal (they did attest).

Approach

Canonicalize the attester signature's recovery byte to v ∈ {27,28} (which keeps (r, s) and the recovery bit, so the recovered address and the signer's vote are preserved), at three layers:

• orderAttestations — the honest path that assembles the L1 bundle, via the existing normalizeSignature. It runs before the adversarial-injection manipulation used by the invalid-attestation e2e tests, so those deliberately-malformed signatures are left untouched.
• Attestation pool ingress (tryAddCheckpointAttestation and addOwnCheckpointAttestations) — defense in depth, so stored and re-gossiped bytes are always canonical.
• CommitteeAttestationsAndSigners.packAttestations itself — its empty-slot check now matches getSigners() (r, s, v all zero, not just v === 0), and it canonicalizes a yParity recovery byte (0/1 → 27/28) when packing. This rewrites only the v byte — it does not touch (r, s) and leaves any other v value as-is — so the injectHighSValueAttestation / injectUnrecoverableSignatureAttestation / MaliciousCommitteeAttestationsAndSigners paths (which inject malformed signatures after orderAttestations to verify L1 rejection) still behave as before. A full normalizeSignature inside the class would break them; the v-byte-only fix does not.

Regression tests cover both v = 0 and v = 1 at the orderAttestations layer, the pool ingress layer, and directly on packAttestations (each asserted red first, e.g. bitmap popcount 3/4 vs signers 4, then green).

Fixes A-1351