Add a stateless block verifier for openvm-eth witnesses

[leonardoalt]

Summary

stateless <witness.bin> verifies an Ethereum block against an openvm-eth
stateless witness and prints the block hash, the same job openvm-eth's zkVM
guest does (reading a file instead of a hint stream, and using this repo's Lean
crypto rather than ZK precompiles). Both cached mainnet witnesses verify end to
end, and building it surfaced two real EIP-7702 gas bugs in the semantics.

Changes

• Data/WitnessTrie.lean: a partial MPT. Data/Mpt.lean rebuilds a trie from
  a complete key/value list, which cannot represent a state trie whose untouched
  subtries are only known by hash. Adds the digest node, openvm-eth's node
  stream decoder with per-node reference checking, incremental insert/delete,
  and a reference cache so the post-block rehash only touches changed paths.
• Block.lean: the consensus block layer (full header, five EIP-2718 envelopes,
  withdrawals, receipts, logs bloom, the RLP encodings behind the block hash and
  four roots, sender and authority recovery). fakeExponential moves here from
  the test helper and becomes total rather than partial.
• Data/Bincode.lean and Stateless/Input.lean: the witness wire format.
• Stateless/Verify.lean: the state transition plus every header commitment.
• Tx.run gains an optional resolve : State → State hook, id for every
  existing driver. A witness keys state by keccak with no preimages, so the
  world cannot be populated before execution starts; the verifier fills in each
  step's reads just before it runs. The module header explains why that needs
  both stack-operand reading and trial-stepping.
• Tx.execute now reports gasUsed, the final substate, and whether a
  transaction was rejected rather than executed. Receipts need the first two;
  a block verifier must treat the third as a consensus failure.
• Two semantics fixes: the missing EIP-7702 authorization refund (12500 when the
  authority already exists in the trie), and warming a delegated recipient's
  delegate, which the top-level frame resolves to get the code it runs.
• witnesstrietests: differential test of the partial trie against the
  full-trie root builder. It caught a real bug on its first run.

Testing

• Both cached mainnet witnesses verify: block 24171384 (53 txs, 11s) and
  23992138 (240 txs, 60M gas, 2m23s). The recomputed block hashes match what
  openvm-eth's reth-benchmark --mode execute-host reports for the same inputs.
• Per-transaction status, gas used and log count match the chain's own receipts
  (via eth_getBlockReceipts): 53/53 and 240/240 exact.
• EEST state tests: eip7702_set_code_tx (1100) and Osaka (2134), 0 fail,
  0 crash. The 7702 fixes move 366 of them from the pass_core tier to
  pass_root (632 to 998).
• witnesstrietests passes, the full CI target build is warning clean, and
  lake lint passes.

Notes

• Both gas bugs were invisible to CI: the state-test runner downgrades a
  balance/state-root mismatch to a weaker pass tier instead of failing, so
  fail was 0 before and after. VMTESTS.md now records that blind spot.
• Only the field-encoded block variant of the witness is decoded, which is what
  the powdr fork writes and what both cached inputs use. Upstream openvm-eth's
  RLP-encoded block variant is detected and rejected with a clear message;
  supporting it needs an RLP envelope decoder.
• Type-1 (EIP-2930) envelope decoding is written by analogy but unvalidated,
  since neither block contains one.
• Parent-relative header checks (gas limit band, base fee formula, timestamp)
  are not performed, matching openvm-eth's guest, which does not call
  validate_header_against_parent either.
• Execution dominates the runtime (140s of the large block's 143s); decoding and
  all trie work account for about 2s.