feat(fastsync): verifiable anchor bundles, captured at scan time (#113)

[LiranCohen]

Summary

Second piece of the ION fast-sync overlay (epic #111), on top of the #112 merkle proofs. A node can now retain, per kept anchor, a self-contained PoW-verifiable bundle so it can later serve fast-sync inclusion proofs without retaining or re-fetching full blocks (which the Bitcoin network serves poorly due to pruning).

What's here

• internal/fastsync/bundle.go — Bundle{Height, TxIndex, RawTx, Branch}. Verify(root) recomputes the txid from the non-witness RawTx (rejecting trailing garbage), checks the merkle branch against a caller-supplied, PoW-verified header merkle root, and returns the proven txid. Compact binary encode/decode.
• internal/fastsync/store.go — a bbolt Store keyed by txnum (height<<32|txIndex): Put/Get/Range/Close. Auxiliary serving data in its own file (like the txid index), so a non-serving node pays nothing.
• internal/index — BundleWriter interface + WithBundleWriter + BundlesEnabled(); scanBlock computes the merkle branch (it still holds the full block) and records a bundle for each kept anchor. Best-effort — a capture failure is logged, never fatal.

A fast-sync peer is untrusted, but a Bundle verified against the receiving node's own header merkle root makes "this anchor exists at block H, index I" impossible to forge. Omission is handled later by trust-then-verify (#116).

The cmd flag to enable capture ships with the serving protocol (#115) — there's no consumer until then.

Tests

• Bundle.Verify against a real CalcMerkleRoot root; rejects tampered branch / wrong root / trailing-garbage tx.
• Encode round-trip + truncation / over-long-branch decode errors.
• Store Put/Get/Range.
• End-to-end: a captured bundle verifies against the block's header merkle root — mutation-verified (an off-by-one capture index fails).

go test -race ./... green (28 packages).

Post-Deploy Monitoring & Validation

No additional operational monitoring required: not wired into the runtime yet (no --serve-fast-sync flag until #115); capture is opt-in and best-effort.

Part of #111. Closes #113

🤖 Generated with Claude Code