fix: tolerate unknown proposer duties without spawning QBFT

[shane-moore]

Problem, Evidence, and Context (Required)

An absent proposer-duty schedule is not evidence that a validator has no duty. The current proposer path can therefore reject honest inbound messages when local duty data or validator indices are missing. Simply accepting those messages is also unsafe if network input can allocate an unverified QBFT instance.

Closes #1190.

Change Overview (Required)

• Validate proposer duties by message-ID pubkey with the existing Assigned, Unknown, and NotAssigned contract.
• Continue validation for Assigned and Unknown; return NoDuty only for authoritative NotAssigned.
• Recompute the assignment inside QbftManager::receive_network_message: Assigned may create an instance, Unknown can use only an existing instance, and NotAssigned drops before map access.
• Keep allocation behavior unchanged for non-proposer QBFT roles.
• Remove the legacy validator-index and first-slot RANDAO exception paths.

No wire, topic, fork-schedule, database, or configuration change is included.

Risks, Trade-offs, and Mitigations (Required)

• An Unknown message with no existing instance is accepted by gossip validation but dropped locally without buffering. Replay and count state has already been consumed, so the same message is not deferred for later delivery.
• EnvelopeProposer has no local QBFT initializer today, so its Unknown path is normally drop-only.
• The dispatch-time lookup is point-in-time rather than transactional with map insertion.

The manager owns the gate at the typed-map routing boundary. ExistingOnly performs one lookup without falling through to allocation, and tests cover both proposer roles, all verdict transitions, exact-key isolation, fork gating, and unchanged controls.

Validation (Required)

• cargo test -p duties_tracker -p message_validator -p qbft_manager -p message_receiver --no-fail-fast
• cargo check -p client
• make cargo-fmt-check
• make lint
• make test

Rollback (Required for behavior or runtime changes; optional otherwise)

Revert this PR. It has no persistent-data, configuration, or wire-format migration.

Blockers / Dependencies (Optional)

Keep as draft until:

• fix(message_sender): validate outbound messages statelessly #1193 merges. This branch is stacked on its stateless outbound-validation changes and should drop those duplicate commits after merge.
• refactor(duties_tracker): retain proposer-duty v2 response metadata #1183 lands. It establishes complete proposer schedules before missing assignments become authoritative NotAssigned evidence.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 91.58317% with 42 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.32%. Comparing base (09b302d) to head (a24bfef).

Files with missing lines	Patch %	Lines
anchor/message_validator/src/lib.rs	90.21%	18 Missing ⚠️
anchor/message_receiver/src/manager.rs	0.00%	11 Missing ⚠️
anchor/message_sender/src/network.rs	0.00%	9 Missing ⚠️
anchor/network/src/network.rs	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             epbs    #1199      +/-   ##
==========================================
+ Coverage   71.95%   72.32%   +0.37%     
==========================================
  Files         168      168              
  Lines       33797    34009     +212     
==========================================
+ Hits        24317    24597     +280     
+ Misses       9480     9412      -68     

Flag	Coverage Δ
rust	72.32% <91.58%> (+0.37%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.