Audit followup: address review feedback (#63) + internal findings

[olegshmuelov]

Summary

Tracks deferred items from PR #63 audit review and additional internal findings.
To be addressed as a focused followup PR after #63 merges to stage.

PR #63 review threads

• Test coverage for updater refactor — mockHeadStateBuilder + parametric tests over revert classifications (thread)
• BuildHeadStateSnapshot — idempotency docstring (thread)
• GetFinalizedClusters — batched SELECT ... IN (?, ?) to avoid serialising DB I/O (thread)
• storeRawEvent — remove dead !errors.Is(parseErr, errUnknownEvent) branch (thread)
• applyClusterEventToOverlay — doc note on operator-set assumption (thread)
• oracle.commit — reorder VerifyFinalizedBlockRoot before GetActiveValidators (thread)

Additional findings

• Missing tests for revert-reason classifications (SSV-OR-3 / 8 / 9)
• processAllClusters stats undercount on SSV-OR-9 early-return
• Pin Go toolchain in go.mod
• BuildHeadStateSnapshot failure marks event processed → consider retry-before-advance

Out of scope

• Aliasing concern (defensive copy in overlayLookup) — discussed in PR #60 thread, going with the documented-contract approach. Revisit only if patterns prove fragile.