feat(validator_store): produce the sync-message partial signature on committee-vote decide

[shane-moore]

Goal

Produce the sync-committee-message partial signature immediately when the committee vote decides, instead of waiting for Lighthouse's SyncCommitteeService timer. The shared per-committee partial-signature batch bundling stays as is.

Context / motivation

Spin-out of #1092, Phase 2 of the validation posted there: #1092 (comment).

• The per-committee partial-signature batch flushes only when full (signature_collector), and its expected size counts attesting plus sync validators (voting_message_count_for_committee). On slots where any cluster validator is in the current sync committee, publish therefore waits for the sync partial signature.
• Lighthouse's SyncCommitteeService is timer-only at 3999ms and not fork-aware at the current pin (SYNC_MESSAGE_DUE_BPS_GLOAS is explicitly unimplemented). Anchor cannot make Lighthouse call earlier; it can only produce the partial signature on its own initiative.
• Consequence: sync-overlap cluster-slots publish at >= 4s regardless of the start-gate fix, for the whole ~27h sync-committee period.
• go-ssv parity: its committee runner signs attestation and sync partial signatures immediately after the decide, so it has no sync-overlap bottleneck.
• The data is available at decide time: the sync message signs the decided vote's block_root (the Lighthouse-supplied duty root is discarded today), and the slot-scoped voting context already tracks the sync validators.

Implementation approach

To settle at PR time; the natural hook is the tail of decide_committee_vote, where #1128 records the committee decision (VotingContext::remember_decided_vote).

Open design points:

• Kick plumbing: keep scheduling/gating in validator_store/metadata service, not inside qbft_manager or signing paths (effects at the seam).
• Dedupe: the later timer-driven sign_sync_committee_signatures call from Lighthouse must not double-produce partial signatures or error.
• Publish path: how the reconstructed signature reaches Lighthouse's publish flow (the timer call is also what publishes the final SyncCommitteeMessage to the beacon node today).
• Ships with its own disable flag (killswitch per phase).

Acceptance criteria

• On sync-overlap slots with a decided committee vote, the sync partial signature is produced at decide time and the per-committee batch flushes without waiting for the Lighthouse timer.
• The later Lighthouse timer call neither double-produces nor errors, and the final sync message still reaches the beacon node.
• Attestation-only cluster-slots are unaffected.
• The feature can be disabled via its own flag.

Depends on #1128 (introduces the decision handoff this builds on and rewrites the same decide_committee_vote/VotingContext region). Distinct from #1114, which adopts Lighthouse's timer values but keeps the timer trigger. Related: #1092, #1113.

[shane-moore]

Closing as superseded by sigp/lighthouse#9675, which removes this ticket's premise ("Anchor cannot make Lighthouse call earlier"). Lighthouse's SyncCommitteeService now races a head event against its due timer, so the sync signing path is called at head arrival, the sync duty attaches to the shared committee QBFT instance early, and the per-committee batch flushes at decide with no Anchor-side kick. It also wires SYNC_MESSAGE_DUE_BPS_GLOAS so the timer fallback tightens to 3.0s at Gloas.

This keeps scheduling in the Lighthouse services (the architecture constraint that made a decide-time kick an anti-pattern) and reaches Anchor at the next pin bump after 9675 merges. Can reopen if 9675 stalls.