[codex] Cache PM recovery index

[wallscaler]

What changed

• Cache the deterministic per-miner challenge_id -> seq recovery index per (hotkey, epoch, tier, allotment, seed fingerprint).
• Keep identity binding unchanged: foreign hotkeys and stale/rotated seed IDs still recover to None.
• Add verifier coverage for cache hits, hotkey isolation, allotment changes, and seed rotation.

Why

#296 fixed false assignment_required_fetch_challenges_first rejects caused by replica lag. The fallback was correct, but under load it could rescan the miner allotment on every lagged submit. This makes the fallback amortized O(1) after the first lookup for that miner/epoch/tier.

Risk / compatibility

• No API shape changes.
• No validator/miner update required.
• The cache is a performance hint only; submit still regenerates and verifies the CNF before accepting.
• Cache memory is bounded by CATHEDRAL_PERMINER_RECOVER_INDEX_CACHE; effective entries are roughly cache size times per-tier allotment.

Validation

• Claude adversarial review: no blockers.
• UV_LINK_MODE=copy uv run --extra publisher python publisher_verify.py -> PASS all 150 checks.
• UV_LINK_MODE=copy uv run --extra publisher python assigned_lane_verify.py -> PASS all 15 checks.
• UV_LINK_MODE=copy uv run --extra publisher python weights_verify.py -> OK 32 checks.
• UV_LINK_MODE=copy uv run --extra publisher python -m compileall scaffold publisher_verify.py assigned_lane_verify.py weights_verify.py -> PASS.
• git diff --check -> PASS.