fix: batch verifier review fixes

[ludamad]

Summary

Review fixes for #21460 (batch chonk verifier service), addressing findings from a 4-agent code review:

• S1 — Shell injection: Replace execSync(mkfifo ...) with execFileSync('mkfifo', [...]) in production code (batch_chonk_verifier.ts) and test code (batch_verifier.test.ts). The bench and queue test files already used the safe form.
• S2 — Silent truncation: Add BB_ASSERT(len <= UINT32_MAX) in write_frame before the uint32_t cast to catch >4GiB payloads instead of silently truncating.
• P1 — Bisection optimization: When bisecting a failed batch, check the left half first. If it passes, all failures must be in the right half — skip the redundant batch_check call. This halves bisection cost for the common single-bad-proof case (3 batch_checks instead of 6 for a batch of 8).
• P2 — O(1) queue front-erase: Change queue_ from std::vector to std::deque so front-erasure in coordinator_loop is O(1) instead of O(n).
• P4 — Single syscall write: Combine the 4-byte header and payload into a single buffer in write_frame for one write() syscall instead of two.
• P5 — Default harmonization: Change C++ BatchVerifierConfig::batch_size default from 4 to 8 to match the TypeScript default.

Test plan

• Existing batch verifier tests (batch_verifier_queue.test.ts, batch_verifier.test.ts) cover all bisection patterns including random patterns with multiple bad proofs — these validate the P1 bisection optimization.
• The execFileSync change is a drop-in replacement with identical behavior for valid paths.
• The std::deque change is API-compatible with std::vector for all operations used.