feat(op-supernode): rework interop activity startup

[ajsutton]

Replaces the EL-finalized-head cold-start heuristic with a deterministic verifiedDB-resume / SafeDB-first-entry model.

Why

The previous startup logic was a tangle:

• resolveFirstVerifiableTimestamp used EL finalized head as the cold-start origin — the wrong signal (EL's view of finality, not proof that derivation has run).
• A retry loop conflated transient EL not-ready with permanent SafeDB gaps.
• Backfill ran before deciding the verification start timestamp.
• firstVerifiableTimestamp re-derived its value lazily, sometimes with I/O, from RPC handlers.

What changed

• Resume always wins. Any committed verifiedDB entry resumes at LastTimestamp+1 without consulting SafeDB or chain RPCs.
• Cold start waits for every chain to record a first SafeDB entry, then sets verificationStartTimestamp = max(activationTimestamp, max first-safe-head timestamp). Wall-clock time is never consulted.
• Backfill clamps lower bound to `max(activation, per-chain genesis, verificationStart - depth)`. Hard fails if any chain can't serve the range. `reconcileLogsDBTail` runs only during cold-start backfill.
• Start splits into a fast init + stateful main loop. The loop drives both cold-start init and `progressAndRecord`, so `Start` never blocks on multi-day EL sync waits. Per-iteration backoff, cancellation, and observability come for free.
• `firstVerifiableTimestamp` is now a synchronous accessor; RPC handlers return `ErrNotStarted` until init completes.

New API surface:

• `SafeDBReader.FirstEntry` (op-node) → `VirtualNode.FirstSafeHeadEntry` → `ChainContainer.FirstSafeHeadTimestamp`. Returns `ErrSafeDBEmpty` during cold-start wait.

Tests

• `startup_test.go` covers `fastInit` resume / cold-start, the `advanceColdStartInit` state machine, cold-start backfill no-op paths, per-chain genesis clamp, RPC `ErrNotStarted` semantics, and the four `reconcileLogsDBTail` edge cases (misaligned activation, offline-reorg recovery, ahead-tip canonical no-op, ahead-tip divergent rewind + catch-up).
• Deleted `log_backfill_test.go` and the obsolete EL-finalized-head startup tests in `interop_test.go` — replaced by the above.
• End-to-end resync acceptance tests (post- and pre-activation, with/without EL data wipe) are tracked as follow-up work, not included here.

[wwared]

LGTM

Some test gaps Claude mentioned that seem valid:

• TestLogBackfill_MisalignedActivation was removed but no equivalent test for "backfill with activation misaligned with block boundary" exists. Seems important to cover.
• TestLogBackfill_RecoversFromOfflineReorg used to test that reconcileLogsDBTail would recover from a reorg, but no new test covers the reorg-recovery behavior even though reconcileLogsDBTail is still called by backfillChain.
• TestLogBackfill_TrimsNonCanonicalAheadLogsDBAndCatchesUp and TestLogBackfill_LeavesAheadLogsDBUnchanged deleted and no equivalent re-added. These used to cover the "leave alone if canonical" and "trim if non-canonical" code paths.

(I approved but we don't want to merge this before #20824 gets reviewed and merged into this PR first)

[wiz-0f98cca50a]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[ajsutton]

Restored those tests - they can only apply if backfill is interrupted now (vs any restart) but still worth keeping.