Boole convergence (#2941) — deferred polish items from full-pass review

[momosh-ssv]

Non-blocking items surfaced during the #2941 full-pass review. None are correctness/security bugs (those were fixed in #2941); these are consistency, doc, and drift-risk cleanups worth doing as a batch.

Note: two items originally here are covered in more detail by the reviewer's tracking issue #2978 and have been moved there to avoid duplication — the custom-config next_domain_type non-rotation (#2978 item 1) and gating the Boole-topic whitelist on BooleForkScheduled() (#2978 item 2). This issue tracks the remainder.

Exporter API

• exporter/validator.go:68-75 — a validator-traces range straddling the Boole fork is rejected wholesale: validation evaluates the fork at request.To while dispatch is per-slot. A dashboard polling a fixed window starts 400-ing when the window's tail crosses the fork. Decide: evaluate at From, or split the range and reject only the post-fork portion.
• /committee with no roles filter can now return two traces per (slot, committeeID) (one per committee runner role), distinguished only by the new role field. Additive-field back-compat holds; cardinality back-compat does not. Note it in the OpenAPI description or default the endpoint to COMMITTEE unless roles is supplied.

Fork-gating consistency

• operator/validator/controller.go — the legacy Alan RoleAggregator/RoleSyncCommitteeContribution runners are gated on BooleFork() evaluated once at share-add time, not per duty slot. Dormant post-fork (harmless), but for ~34 slots after the fork two node populations behave differently on the same pre-fork RoleAggregator message. Consider slot-gating for symmetry, or note it retires with the Alan topics.

Config / misc

• Duplicated aggregator-selection modulo/sha256 logic between beacon/goclient/aggregator.go and protocol/v2/ssv/runner/aggregator.go — must stay bit-identical or pre/post-Boole aggregator selection diverges. Extract a shared helper.
• No startup sanity check on a garbage custom forks.boole epoch (e.g. a typo'd huge-but-not-MaxUint64 value, or an epoch before genesis) — it silently produces odd fork timing on custom networks. Add a startup validation/warning. (The related next_domain_type non-rotation case is Boole convergence: non-blocking hardening follow-ups from the #2941 review #2978 item 1.)
• protocol/v2/qbft/spectest/error_code_map_alan.go — the remap bound code <= 79 is disconnected from the real v1.2.2 max (72); tighten or derive from a named constant. (Held from Boole → stage convergence — final consolidation #2941 because it can only be validated against the alan spec vectors.)

No action needed (recorded for completeness)

• Discovery-level domain filter stays on the static current domain by design (real enforcement is the handshake filter + per-slot validation).
• The transient stale-subscription window at the fork boundary self-heals within ~1s via the UpdateSubnets reconciliation ticker.

Coverage

Fork-boundary tests and the aggregator-committee-runner unit surface are tracked in #2964.