checkpoint: persist malicious identity

[countvonzero]

Description

at genesis we don't prune ATXs from malicious identities. these ATXs will be checkpointed and golden after a recovery.
this allows adversaries to misbehave right after a network upgrade/recovery.

in order to preserve malicious identity during checkpoint, we also need to preserve the malicious proofs and make them "golden" in the sense that it cannot be verified.