fix(consensus): hold delegated EOAs to their key in delegateStake - #165

Closes #163, closes #164.

#163 - delegateStake silently switches from ecrecover to ERC-1271

Confirmed, both halves, with tests that fail on master.

SignatureCheckerLib.isValidSignatureNowCalldata branches on extcodesize before anything else. A 7702-delegated EOA carries 23 bytes of 0xef0100 || implementation, so the branch is not taken and ecrecover is never reached. The check becomes an ERC-1271 staticcall against whatever the EOA currently delegates to.

• Liveness. test_delegateStake_delegatedEOA_acceptsKeySignature reverts NotValidator on master even though the validator signed the digest with its own key. Any 7702 wallet without a matching ERC-1271 handler is unonboardable, with nothing in the revert to say why.
• Authorization. testRevert_delegateStake_permissiveDelegateCannotAuthorize succeeds on master with the four-byte signature 0xdeadbeef. The digest is public via tn_delegationDigest, so a permissive handler is enough to bind an arbitrary delegator, and _getRecipient sends every later claimStakeRewards and unstake there.

Fix

Route on what kind of account the validator actually is rather than on code size:

if (_isDelegationDesignator(validatorAddress)) {
    return ECDSA.tryRecoverCalldata(digest, signature) == validatorAddress;
}
return SignatureCheckerLib.isValidSignatureNowCalldata(validatorAddress, digest, signature);

The designator is matched by its 0xef0100 prefix, not merely its length. EIP-3541 forbids deployed code from starting with 0xEF, so the prefix is unambiguous, and a real 23-byte contract still routes to ERC-1271 (testRevert_delegateStake_twentyThreeByteContractIsNotADesignator).

Delegated EOAs are now held to their secp256k1 key exactly as undelegated ones are; only genuine contract accounts reach ERC-1271, and test_delegateStake_contractValidator_usesERC1271 pins that we did not break them. An operator who has moved to a smart account and no longer holds the key still has two routes in: stake, which authorizes off msg.sender, and the governance path, which skips the signature check entirely.

#164 - 7702 dissolves EOA screening

The premise holds - screening at mint time is not durable, a holder can attach a reverting delegation afterwards - but the described exploit chain does not reproduce. burn and the slash-to-zero branch of applySlashes both succeed today against a validator whose account rejects every incoming call.

_consensusBurn zeroes balances[validatorAddress] and consolidates the stake on Issuance before reaching _unstake, so _unstake returns at its zero-balance guard and never calls distributeStakeReward. No value is pushed to the validator, and there is no burn payout to convert to a pull-based credit.

What was true is that the property was incidental rather than structural, and actively obscured: _consensusBurn called a function named _unstake, passing a recipient it computed and never used. So rather than a no-op fix, this PR makes the property explicit and pins it:

• _burnConsensusNFT is split out of _unstake (token burn, supply guard, delegation clear - no value movement) and the confiscating path calls it directly. Behavior is unchanged; the misleading payout call is gone.
• Four regression tests cover both ejection paths against hostile account code: a reverting 7702 delegation on the validator, on the delegator (the actual payout recipient when delegated), and the queued version-change escrow, which is the one balance an ejection owes back and which already credits claimRefund rather than pushing. The slash test also concludes the following epoch, since that path runs inside a system call where a revert stalls the closing block rather than merely inconveniencing governance.

These four pass on master too. That is the point: they document a property that currently holds by accident and would otherwise be easy to refactor away.

nonReentrant is deliberately not added to burn. It is onlyOwner and, after this change, provably makes no call to an untrusted address.

Testing

• 11 new tests in test/consensus/ConsensusRegistryEIP7702Test.t.sol
• Verified against master: the four delegateStake silently switches from ecrecover to ERC-1271 #163 tests fail (two NotValidator, two "did not revert as expected"), the four 7702 dissolves EOA screening as a durable mitigation #164 tests pass
• Full suite green under both fast and ci profiles: 324 passed, 0 failed, 2 skipped

Also included

artifacts/ConsensusRegistry.json regenerated, since the source changed and the committed artifact is consumed downstream. Docs updated: the delegateStake natspec now states which authority is competent to sign, and design.md gains bullets for delegation authorization under account abstraction and for the push-free ejection property.