refactor(prover-node): CheckpointStore + SessionManager redesign

[PhilWindle]

Summary

Replaces the monolithic EpochProvingJob with a content-keyed CheckpointStore,
a long-running SessionManager that owns ephemeral EpochSessions, and a new
ProofPublishingService that centralises L1 submission. ProverNode becomes a
thin event translator: each L2BlockStream event is applied to the store / chonk
cache, then dispatched to the session manager and publishing service via single
method calls.

The redesign closes a class of optimistic-proving bugs that the old sticky
epochComplete flag and per-session publish path made structurally hard to fix,
and lays the groundwork for re-using sub-tree work across epochs.

See yarn-project/prover-node/README.md for architecture diagrams, state
machines and event-flow sequences.

Architectural changes

• CheckpointProver is content-addressed by (number, slot, archiveRoot).
  A prune followed by a re-add of the same content (e.g. brief L1 reorg) reuses
  the in-flight sub-tree work — no replay. The CheckpointProver starts its own
  tx gather + sub-tree pipeline in its constructor; there's no provideTxs API.
• CheckpointStore owns the registry, the SlotWatcher (a RunningPromise
  reaping pruned-past-slot CheckpointProvers), and reapExpired (drops canonical
  CheckpointProvers once their epoch's proof-submission window has closed, so the
  proof can no longer be accepted on L1).
• EpochSession spec is slot-based: [firstSlotOfEpoch(N), toSlot]. Every
  session — full or partial — starts at the epoch's first slot because the L1
  rollup requires every proof to extend from the previous proven tip. The
  session does three things: run a TopTreeJob, hand the proof to
  ProofPublishingService as a PublishCandidate, translate the outcome into a
  terminal state. Predecessor gating, same-epoch dedup, deadline enforcement,
  and the L1 tx are all the service's concern.
• ProofPublishingService (new) is the single owner of L1 submission. It
  serialises one publish at a time against a freshly-created publisher,
  per-candidate deadline arms a setTimeout (resolves 'expired' if it
  fires before publishing starts), persistent publisherFactory.create()
  failures are retried on a 1s backoff (capped by the deadline). Once an L1
  publish starts it runs to completion; withdraw is queue-only.
• SessionManager owns the fullSessions / partialSessions maps, the
  reconcile loop, and the periodic tick. Reconcile is uniform across kinds:
  any session whose canonical content shifts is cancelled and recreated with the
  same spec but new content. The tick high-water mark advances only after a
  session actually exists for the epoch, so transient blockers (max-pending-jobs
  reached, archiver still indexing) leave the mark in place and the next tick
  retries.
• ChonkCache moved from per-epoch to a single prover-node-wide cache in
  prover-client/orchestrator, keyed by tx hash. Entries are released by the
  per-event expiry sweep (releaseForBlocks) once an epoch's proof-submission
  window has closed — there's no longer any proof to produce for those txs.
• Reconcile and publishing-service drain each run on their own
  SerialQueue from @aztec/foundation/queue so concurrent events can't
  interleave on an await and race.

Removed

• EpochProvingJob and its sticky epochComplete flag, the
  finalizationScheduled flag, the in-class restart loop, the 'reorg' state.
• ProvingOrchestrator and EpochProvingState (test-only legacy);
  CheckpointSubTreeOrchestrator now extends ProvingScheduler directly.
• TopTreeProvingScheduler collapsed into TopTreeOrchestrator (single
  concrete subclass).
• EpochProvingContext (thin facade over ChonkCache); the sub-tree takes
  ChonkCache + EpochNumber directly.
• CheckpointParent interface (vestige of EpochProvingState as a real parent);
  the per-checkpoint state takes three discrete epochNumber/isAlive/onReject
  deps from its owner.
• ProverNodePublisher.interrupt() / .restart() and the entire mid-publish
  interrupt code path. The bug where l1TxUtils.interrupted leaked between
  publishes (the publisher is created fresh per publish but wraps a pooled
  L1TxUtils) is gone by construction.
• CheckpointStore.resume() (dead code) and implements Service on
  CheckpointStore.
• ReconcileTrigger variant 'finalised' and SessionManager.onChainFinalised
  (redundant nudge; every reconcile already runs the recreateInvalidSessions
  sweep).
• ProofPublishingService.onPrune (redundant with the session-manager path
  which already calls withdraw(uuid) for every cancelled session).

Smaller fixes folded in

• tipsStore.handleBlockStreamEvent moved to the finally block so a throwing
  handler doesn't claim progress that didn't happen.
• Failure-upload snapshots every CheckpointProver regardless of sub-tree
  completion.
• ProverClient.stop() uses tryStop(facade) to swallow already-stopped errors.
• lastExpiredEpoch seeded from the last fully-proven epoch in start() so a
  restart never re-sweeps epochs that already reached L1.
• DateProvider plumbed through EpochSession, SessionManager,
  ProofPublishingService — no direct Date.now() anywhere.
• Branded types throughout: Map<EpochNumber, ...> on session-manager and
  publishing-service Maps; TopTreeJob.getRange() returns CheckpointNumber.

Test plan

• yarn workspace @aztec/prover-node test — 161 unit tests pass (includes
  new proof-publishing-service.test.ts, checkpoint-store.test.ts).
• yarn workspace @aztec/prover-client test src/orchestrator/ src/test/bb_prover_full_rollup.test.ts
  with FAKE_PROOFS=1 — 24 tests pass.
• yarn workspace @aztec/stdlib test src/interfaces/prover-node.test.ts —
  passes (state enum still includes legacy values for API compatibility).
• yarn build — full monorepo TypeScript build clean.
• yarn format / yarn lint clean across prover-node, prover-client,
  and end-to-end.
• yarn workspace @aztec/end-to-end test:e2e e2e_optimistic_proving and
  e2e_multi_proof — exercised by CI.
• Kind-mode network run with a synthetic L1 prune to confirm the
  cancel-and-recreate path lands a valid proof on L1.

[spalladino]

Looks great! I'll miss the good old epoch-proving-job.

Out of all the comments, I think the only important one to address is the always-advancing of local chain tips when handling blockstream events in the prover-node.