feat: sequencer streaming message selection, flag off (A-1382)

[spalladino]

Implements A-1382 (FI-12): sequencer streaming Inbox message selection behind a streamingInbox flag, default off. Part of the Fast Inbox stack (AZIP-22).

Flag semantics

• One shared env var STREAMING_INBOX -> streamingInbox: boolean (default false), defined once in stdlib's sharedSequencerConfigMappings so the sequencer reads it now and the validator (A-1383) maps the same env. Flag off is byte-identical: the new paths are gated at checkpoint start and per block.
• With the flag on, checkpoints are expected to fail L1 submission (on-chain propose still enforces the legacy per-checkpoint consumption until the flip, A-1384). The streaming path is exercised with unit/mock tests only.

Selection policy (mirrors ProposeLib.validateInboxConsumption)

New pure selector sequencer-client/src/sequencer/inbox_bucket_selector.ts, run per block:

• Pick the newest lag-eligible bucket (getLatestInboxBucketAtOrBefore(now - INBOX_LAG_SECONDS)); on the checkpoint's final block, also consider the cutoff bucket and take the newer, so consumption reaches the censorship floor.
• Walk back from the candidate to the newest bucket that fits both the per-block cap (bucket.totalMsgCount - parent.totalMsgCount) and the per-checkpoint cap (bucket.totalMsgCount - checkpointStartTotalMsgCount). If even the first forward bucket overshoots the per-checkpoint cap, consume nothing — matching L1's cap-escape (next.totalMsgCount - parentTotal > MAX_L1_TO_L2_MSGS_PER_CHECKPOINT).
• The inclusive <= comparisons make a bucket exactly INBOX_LAG_SECONDS old eligible and a bucket exactly at the cutoff mandatory, matching L1's strict next.timestamp > cutoff.

Cutoff is computed as getTimestampForSlot(slot - 1) - INBOX_LAG_SECONDS, matching ProposeLib exactly (not the consensus timetable's getBuildFrameStart, which subtracts an extra ethereum-slot). Boundary vectors pinned against A-1371 resolution section 13.

Cutoff floor

On the checkpoint's final block (including the block that reaches the per-checkpoint block cap) the cutoff is a consumption floor, so the checkpoint's own header would pass the L1 censorship assert post-flip.

Builder interface change

• ICheckpointBlockBuilder.buildBlock gains an optional per-block l1ToL2Messages bundle; ICheckpointsBuilder.startCheckpoint gains insertMessagesPerBlock. Threaded through FullNodeCheckpointsBuilder/CheckpointBuilder and the lightweight builder (first-in-checkpoint bundle padded, non-first compact; the inHash/rolling hash recompute over the accumulated logical messages).
• An optional signed bucket reference is threaded onto block proposals (Validator.createBlockProposal -> ValidationService -> BlockProposal.createProposalFromSigner).

Constant

INBOX_LAG_SECONDS = 12 added to constants.nr and regenerated into the TS constants (constants.gen.ts). Not emitted to ConstantsGen.sol (Solidity whitelist); ProposeLib keeps its local copy pending consolidation (A-1434).

Open item / to verify on CI

• Non-genesis cross-checkpoint parent-bucket sourcing is not wired: there is no by-rolling-hash archiver lookup and legacy parents do not sit on a bucket boundary, so only the genesis base case is resolved and non-genesis throws (safely caught -> skipped proposal). This is a flip-time concern.
• Local build/typecheck of sequencer-client, validator-client, prover-client is blocked by the known stale-artifact/@aztec/bb-avm-sim breakage, so CI is the typecheck of record for the job/builder/proposal edits. The pure selector unit tests and the stdlib config changes were verified locally.