Verify the blobs bundle against the block's blob hashes

[0w3n-d]

Issue: #527 (step 8 of 10)

Base branch: od/builder-sim-blacklist-step6 (#535, step 6). Retarget as the
stack merges.

What this PR does

validate and validate_merged take the submission's BlobsBundle and check
it against the block:

• blob, commitment and cell-proof counts agree (blobs * CELLS_PER_EXT_BLOB);
• the block's blob versioned hashes, gathered in order across every blob
  transaction, match the bundle's commitments;
• verify_cell_kzg_proof_batch accepts the proofs.

ethrex's own BlobsBundle::validate is per transaction, and a submission
carries one bundle for the whole block, so it does not fit that shape. The parts
that do fit — validate_blob_commitment_hashes and the KZG batch verify — are
called directly rather than reimplemented.

Blob gas accounting needs nothing here: verify_blob_gas_usage already runs
inside validate_block_pre_execution, which step 4 calls.

What this PR deliberately does not do

No pre-Fulu bundle format. Only EIP-7594 cell proofs are accepted, matching the
decision to serve V5 and the merged method only.

Tests

Written first and signed off before implementation. 7 new, 48 in the file:

• A valid one-blob block passes. It asserts blob_gas_used > 0, so it cannot
  pass by the blob transaction having been dropped from the block.
• Commitments that do not match the block's hashes, a short proof list, a
  corrupt cell proof, a spare blob, and an empty bundle for a block that has a
  blob transaction are each rejected.
• A bundle attached to a block with no blob transactions is rejected.

The bundles are real: BlobsBundle::create_from_blobs computes genuine
commitments and cell proofs, and verify_cell_kzg_proof_batch is doing actual
work in these tests.

One fixture note: the blobs differ from each other by construction. With
all-zero blobs every commitment is identical, which silently turned the
commitment-mismatch test into a no-op — it passed while testing nothing.

just fmt-check, just test and cargo clippy --all-features --no-deps -- -D warnings
are clean. 82 tests pass in helix-builder, up from 75.

Reviewer checklist

• CI (lint, unit-test) is green
• Matches the linked issue/step
• No unexplained scope creep or unrelated files touched