fix(payout): cap fee-drift surplus at the ratified treasury allocation, overflow into the node pool (#601)

[defenwycke]

Closes #601. This is step 1 of the #608 release sequence — "land fix/601-drift-cap-and-sink (1 commit, unmerged since 12 Aug, touches a live money path: main has no drift cap)".

The commit is bda4c0013, authored 2026-08-12, cherry-picked onto c78dda2e2 cleanly with no conflicts. Its original PR (#655) was closed rather than merged, so the fix never landed: bda4c0013 is not an ancestor of main and no equivalent change exists there. Verified by ancestry, not by grepping subject lines — a subject-line search is what made it look merged in the first place.

What it does

Post-gate surplus drift no longer lands on the treasury uncapped. The treasury's take is capped at its own ratified allocation, so drift can at most double what the decay schedule granted it. Overflow above the cap — including the entire surplus once the decay schedule has driven the ratified treasury to zero — is shared into the node pool pro rata to the ratified node amounts, remainder to the top entry, ties broken by address. Overflow with no node pool to absorb it fails closed to the fallback coinbase.

The cap is a pure function of the ratified checkpoint, so the builder and the settlement reconstruction stay byte-identical on every node, and the outputs balance exactly to subsidy + available fees.

Context for why this matters in practice: ratified tx_fees is 0 at a tip change, so roughly 1.5% of the coinbase currently drifts to the treasury. That is not a double-count, but it is unbounded, and main has no cap on it today.

Verification

cargo check -p ghost-pool --features zk-production passes against current main — the change still compiles after three weeks of drift in the surrounding tree.

Full ghost-pool lib suite: 481 passed, 0 failed, 0 filtered out. The five tests this commit adds were confirmed present and ok by name, not inferred from a total:

a_surplus_above_the_cap_overflows_into_the_node_pool              ... ok
at_the_cap_boundary_the_sum_still_balances_exactly                ... ok
a_decayed_zero_treasury_sends_the_whole_surplus_to_the_node_pool  ... ok
overflow_is_shared_pro_rata_with_the_remainder_on_the_top_entry   ... ok
a_capped_surplus_with_no_node_pool_fails_closed                   ... ok

⚠ Worth stating why that check is spelled out: a first pass ran cargo test … drift, which matched none of these five names and reported 0 passed; 0 failed with exit code 0. A filtered-to-nothing run is indistinguishable from a green one unless you read filtered out.

Note for the reviewer

This touches the coinbase builder, so it wants a deploy of its own rather than riding another change — the same reasoning that kept the Stage 6 deletion off the cutover binary.