Make PM coldkey mapping opportunistic

[wallscaler]

Summary

• Makes PM/private challenge identity fail open when coldkey_map is missing or partial.
• Uses coldkey identity for mapped hotkeys, and hotkey identity for unmapped hotkeys.
• Removes coldkey_mapping_required as a hard blocker for PM status/challenges/CNF/submit paths.
• Adds PM policy metadata for identity mode and unmapped PM hotkey count in the 24h scoring window.

Why

Production has CATHEDRAL_PERMINER_REQUIRE_COLDKEY=true, but the coldkey map can be stale or partial. That blocks honest miners from the paying PM lane before they can fetch or submit private challenges. This hotfix keeps coldkey collapse where we have the map, while preventing map freshness from becoming an admission gate.

Review Notes

Claude reviewed the core diff adversarially. Verdict: ship as a hotfix. Risk is bounded but real: unmapped hotkeys temporarily score as separate identities until the map converges. This is preferable to blocking honest unmapped miners entirely during stabilization.

Verification

• publisher_verify.py: PASS all 147
• weights_verify.py: PASS all 32
• assigned_lane_verify.py: PASS all 15
• python -m compileall -q scaffold publisher_verify.py weights_verify.py assigned_lane_verify.py: PASS
• git diff --check: PASS

Post-Deploy Checks

• Confirm unmapped PM miners no longer receive coldkey_mapping_required.
• Confirm /v1/validator/weights/next metadata exposes identity_mode and unmapped_hotkeys_24h.
• Watch unmapped_hotkeys_24h and top PM weight concentration until the coldkey map converges.
• Confirm old validator feed /v1/leaderboard/recent still serves signed rows.