Fix signer liveness by completing on quorum signatures

[micahkendall]

Motivation

• A leader previously tracked every peer that sent a commitment in a waiting_for set and only finished a round when that set became empty, permitting a single stalled/malicious peer to indefinitely block publication.

Description

When a round ends, if the leader has not yet received all signatures it expected from that round, it will build whatever payloads it may with the signatures it has.

Testing

• Ran cargo test -q after the change, and all tests passed: 95 passed; 0 failed.
• Local test iterations included an initial failing test used to drive the fix and a final full test run that succeeded.

---

Codex Task

[SupernaviX]

@micahkendall Codex's version of this PR handled a "dos" attack where one signer refused to produce signatures, but did so by waiting for a quorum of responses rather than a quorum of signatures.

That change introduced a simpler attack; we would only collect signatures from 2 nodes, and if either of them was missing a feed, we would not publish that feed. A single malicious node could (very quickly) return 0 signatures from its payload to keep the system down. It wouldn't take malice either; if a single node disagreed about the price of MIDAS, we would not produce a MIDAS feed.

I've fixed both attacks by reverting Codex's changes, and instead making the leader publish whatever possible if it hasn't received all signatures by the end of the round. Now it's got the best of both worlds; the leader waits to collect all the signatures we need, but won't wait forever for any individual node to sign.

[micahkendall]

Cheers