cl: harden blob backfill availability

[domiwei]

Summary

• track completed canonical blob coverage as precise Deneb/Fulu ranges and preserve partial progress across retries
• accept legal partial or reordered blob_sidecars_by_root responses, verify them by identity and proof, and retry only missing sidecars
• make Deneb and Fulu failures truthful, repair stale Fulu recovery state, and bound/coalesce/cancel recovery work
• enforce the Req/Resp concurrency limit across live sync and history backfill
• return a retryable JSON 503 only when requested canonical blob data is still pending, while preserving available filtered data and normal empty responses
• harden persisted blob metadata and Beacon API query validation against malformed, partial, or oversized input

Relationship to #23138

This is a stacked follow-up to #23138. That PR remains the small fix for #22429: the exclusive FrozenBlobs() boundary and the peer startup gate. This PR contains the broader availability contract and robustness work discovered during review, so the issue fix can be reviewed independently.

The temporary base is kewei/fix-blob-backfill-boundary; after #23138 merges, this PR can be retargeted to main without changing its effective diff.

Why

Reporting temporary blob unavailability through the API requires the downloader's completion state to remain accurate across legal partial network responses, fork-specific retention windows, Fulu recovery, canonical reorgs, database commit visibility, and partial persisted data. These concerns are cohesive but materially broader than the original boundary bug, so they live here rather than in #23138.

API compatibility

The Beacon API endpoint schemas do not explicitly enumerate 503 for these blob endpoints. This PR intentionally uses it as an Erigon extension for temporary backfill unavailability. The response follows the shared JSON error shape (code and message) and uses Content-Type: application/json.

An available requested index or versioned hash remains a 200; a 503 is returned only when an expected requested member is missing and its canonical slot is still pending. Empty blocks, unmatched filters, side branches, frozen data, and completed or disabled backfill preserve their normal behavior.

Validation

• go test ./cl/phase1/network ./cl/beacon/handler ./cl/das ./cl/persistence/blob_storage ./cl/rpc ./cl/phase1/stages ./cl/phase1/forkchoice ./cmd/caplin/caplin1 -count=1
• make lint (complete pass: 0 issues)
• make erigon integration
• the pre-split combined tree also passed full make test-all; this stacked branch additionally includes latest-main handler head-state changes and was revalidated with the affected package set above
• five independent Standards, Spec, and Adversarial review/fix rounds converged with no remaining High/Medium finding other than the explicitly documented non-standard 503

[domiwei]

Superseded by #23138. The availability and recovery hardening has been moved back into #23138 as its second, separately reviewable commit. This draft branch is being retained as a backup; no changes were discarded.

[domiwei]

GitHub could not reopen this stale draft after its branch was rebuilt. The replacement follow-up is #23213, with the same intended 503 availability scope on the current verified branch head.