feat(consensus): operate four-validator M1 devnet

[kaikisegfault]

Linked work

Closes #32

Outcome

Deliver the complete M1 four-validator local CometBFT lifecycle: one foreground command initializes and supervises four independent C++/SQLite replicas, exact health and transaction operations observe the full topology, orderly stop preserves durable state, and restart continues from the retained ledgers.

Scope

Included: four equal-power validators, distinct retained validator/node keys, byte-identical common genesis, static loopback full mesh, twelve-child foreground supervision, short-lived Unix-socket isolation, converged non-catching-up health, exact raw transaction submission, public deterministic fixtures, operator documentation, and a real hosted transfer/stop/audit/restart integration.

Excluded: canonical ledger changes, validator updates, staking, state sync, public networking, containers, wallets, and production keys.

Protocol and compatibility impact

Adapter-only compatibility amendment recorded in ADR 0001 and consensus-application-v1.md. CometBFT v0.39.4, ABCI 2.0.0, application protocol v1, ledger bytes, economics, state roots, and database format remain unchanged. Peer order, ports, sockets, timing, and validator metadata remain deployment state.

Verification

Local lightweight checks:

• git diff --check — passed.
• python3 -m py_compile tests/integration/cometbft_four_validator_test.py — passed.
• sh -n tools/devnet.sh tools/verify.sh — passed.
• Local fixture execution correctly refused the host's non-pinned libsodium; no unpinned result was used as evidence.

Hosted exact evidence:

• Code candidate 28d2404: Actions run 30450433782 passed GCC debug, GCC ASan/UBSan, Clang debug, and Clang ASan/UBSan. Debug jobs passed 26/26 CTest targets; Clang sanitizer passed 32/32 including fuzz smoke. Every job passed Go tests/vet, four cgo-free builds, the single-node integration, and the four-validator integration.
• Final PR head 9b45994: Actions run 30450907381 repeated all four jobs successfully.
• The four-validator integration commits two independently modelled signed transfers, models observed intervening empty blocks, stops/restarts all replicas, and audits all four released SQLite ledgers directly through independent C++ application processes after each stop.

Risks and follow-up

This remains loopback-only research software. Generated validator keys are unencrypted development keys. The fixed four-node topology is an M1 operational default, not a production validator-admission or public-network design.

Checklist

• The change is focused and contains no unrelated user work.
• Specifications and ADRs match consensus-visible behavior.
• Negative, boundary, property, differential, and fuzz checks were added or retained where applicable.
• All required verification passed on the exact current head.
• Documentation and current-state.md are accurate.
• No AI author, committer, co-author, or PR participant attribution was added.