cl/phase1: recover unverified Gloas payloads across forks

[domiwei]

Summary

• retry Gloas execution payload envelopes that were deferred while PeerDAS data or EL validation was unavailable
• recover unverified payloads across canonical, highest-seen, and side-fork lineages in dependency order
• make persisted envelope reads owned, crash-safe, corruption-aware, and safe under concurrent retry/admission
• bound recovery scheduling, ancestry scans, output batches, stalled lineages, and checkpoint memory

Root cause

Deferred Gloas envelopes could fall out of the bounded pending queue or survive a restart without being revalidated. Recovery also needed to distinguish FULL payload dependencies from independent EMPTY paths across deep and shared ancestry. Earlier traversal strategies could starve forks, loop on invalid or missing data, lose progress at pagination boundaries, or grow retained continuation state.

Impact

Caplin can recover persisted, unverified Gloas payloads after EL outages, PeerDAS delays, restarts, deep non-finality, and fork changes without allowing one malformed or stalled lineage to freeze the rest of the chain. Recovery remains bounded per cycle.

Validation

• affected CL package suites
• go test -race ./cl/phase1/stages -count=1
• make lint (repeated before push)
• make erigon integration
• deep lineage, FULL/EMPTY, shared ancestry, missing boundary, invalid status, capacity, stalled-lineage, and multi-rollover tests
• independent spec and safety adversarial reviews converged on commit b8107822f04bb703dcb08039a7f2f0df636d7f3a

Review note

This branch is intentionally opened as a draft. At creation time it is 4 commits behind the latest main; rebase and post-rebase validation remain before marking ready.