Add provider slashing to back availability commitments

[flo2517]

Apply economic penalties to providers that fail their availability commitments, so that bonded stake — not just forgone rewards — backs a provider's promise. ADR-011 §5 shipped validator rewards but deliberately deferred slashing, stating that "slashing stake for provably bad submissions is the intended long-term deterrent but its economic parameters need their own analysis". This issue is that analysis and its implementation.

Blocked by: ADR-015 (see ADR-012 §6) — no implementation before acceptance.

Acceptance criteria:

• ADR-015 fixes the economic parameters: what fraction is slashed, for what evidence, over what window, and where slashed funds go;
• slashing triggers only on evidence that is attributable, non-repudiable, and already on-chain — never on a single validator's unaggregated word;
• the interaction with dispute_round and resolve_dispute in blockchain/pallets/network-validator/src/lib.rs is explicit: a slash cannot be finalized while the round that justifies it is disputed, and an upheld dispute reverses it;
• an appeals path exists with a bounded window and a defined resolution origin; governance capture of that origin is addressed by Decentralize identity, governance, and validator operations #36;
• false-positive protection is quantified: a provider suffering a network partition or a validator committee acting in bad faith must not be slashed on quorum-of-colluders alone;
• all balance arithmetic is checked; a slash can never underflow stake, never exceed the bond, and never leave an inconsistent unbonding position;
• degraded quorum reduces confidence rather than producing a slash;
• tests cover a justified slash, a slash reversed by an upheld dispute, a slash attempted during an open dispute window, a colluding minority failing to trigger a slash, double-slash for the same round, and slash-then-exit races against UnbondingPeriod.

---

Original request (FR, preserved verbatim):

Mettre en place des pénalités financières (slashing) pour les providers qui ne respectent pas leurs engagements de disponibilité.

[flo2517]

ADR-015 — this issue's gate — is proposed in #67 (stacked on #65).

Writing it surfaced two things that change this issue's shape, so flagging them here rather than silently editing the body:

1. There is nothing to slash today. pallet-network-validator takes a real bond — ReservableCurrency (lib.rs:161), MinStake (lib.rs:173), reserved on registration (lib.rs:449), released only after UnbondingPeriod (lib.rs:503). But pallet-provider-registry has no Currency association at all, and pallet-lease holds no collateral. Providers bond nothing.

So provider bonding is a precondition for this issue, not a detail of it — and it is the larger half of the work. It lands in pallet-provider-registry, a pallet this issue does not mention, and it changes what provider registration means for every existing caller, including the Control Plane's register_provider_for path (ADR-009). ADR-015 §2 specifies it: bond required to hold leases rather than to appear in the registry, scaled to committed capacity rather than flat, mirroring the shape already proven in pallet-network-validator rather than inventing a second one.

2. This issue now depends on #36. An armed slash must be appealable, and the appeal needs a resolution origin. Today that is EnsureRoot (blockchain/runtime/src/lib.rs:316) — one sudo key deciding whether to destroy a participant's stake. ADR-015 §6 forbids slashing going live while that is the terminal authority. The mechanism can be implemented, tested, and merged behind a disabled parameter; enabling it needs the governance work first. ADR-012 §5 already puts #36 and this issue in the same stage, so the ordering costs no schedule.

Also worth knowing before implementation starts, from ADR-015 §3: being trimmed as an outlier is not evidence of dishonesty. The trimmed mean in close_round discards the highest and lowest submission by construction, so an honest validator observing a genuine edge case is trimmed exactly like a liar. Persistent outlier status may inform selection or rewards; it must never slash on its own.

ROADMAP.md's v3.0 table has been updated to record both dependencies.