fix(forkchoice): correct LMD-GHOST orphan-skip, tighten checkpoint advance, assert start_root

[tcoratger]

Summary

Three correctness fixes surfaced by the consensus-researcher review.

• Removes a dead orphan-skip branch in LMD-GHOST whose comment lied about
  its behavior.
• Centralizes checkpoint advance semantics in Checkpoint.advance_to,
  resolving an inconsistency where on_block and build_block had
  opposite tie semantics because of different max() argument orders.
• Adds an invariant assert at the head walk so a bad anchor fails loudly
  with a useful message instead of a KeyError deep in the weight loop.

Behavior on the hot path is preserved. The only intentional semantic
change is at build_block on slot ties: the store now wins consistently
with the documented intent at on_block.

What was wrong

1. Dead orphan-skip in _compute_lmd_ghost_head

if not block.parent_root:
    continue  # skip blocks without parents (e.g., purely genesis/orphans)

block.parent_root is Bytes32 — always 32 bytes, so bool(parent_root)
is always True. The branch never fired. Genesis blocks landed in
children_map[Bytes32.zero()] instead of being skipped. The bucket was
never consulted because the walk anchors at the justified root and only
descends, so the bug was silent. The filter is removed and the comment
now explains why genesis cannot pollute the walk.

2. Inconsistent tie semantics across max() call sites

# on_block:    "On slot ties, prefer the store's own checkpoint" (documented)
max(store.latest_justified, post_state.latest_justified)

# build_block: same docstring, opposite argument order, opposite behavior
max(final_post_state.latest_justified, store.latest_justified)

Slot-only __lt__ plus max() means tie behavior depends on argument
order. The two sites had opposite orders. The fix introduces
Checkpoint.advance_to(candidate) which encodes the documented "receiver
wins on tie" rule in the type. Both call sites now read:
store.latest_*.advance_to(post_state.latest_*).

3. Missing invariant on _compute_lmd_ghost_head

Both callers pass store.latest_justified.root which is always a known
block. A future misuse would have produced a cryptic KeyError deep in
the weight loop. A one-line assert states the invariant up front.

Test plan

• New unit tests for Checkpoint.advance_to covering higher slot,
  lower slot, slot tie, and idempotence
• New unit test for _compute_lmd_ghost_head rejecting an unknown
  anchor
• Existing test_produce_block_missing_parent_state updated to
  expect the clearer AssertionError
• All 100 tests in tests/lean_spec/subspecs/containers/test_checkpoint.py
  and tests/lean_spec/forks/lstar/forkchoice/ pass
• ruff check, ruff format --check, ty check all green

🤖 Generated with Claude Code