fix(sequencer): make lifecycle idempotent and restartable, with graceful stop

[spalladino]

Supersedes #24449 and #24450, reimplementing both on a simpler design. Single PR since the lifecycle work is only exercised by the e2e primitive.

Context

Several multi-node e2e tests spend minutes of wall-clock waiting for the L1 clock to roll while live sequencers sit idle. Warping the shared clock under a running sequencer interrupts whatever iteration is mid-build, producing the reorg / "Sequencer was interrupted" failures behind earlier revert attempts. Pausing sequencers around the warp requires a lifecycle that can actually stop and restart, which it couldn't: a second start() orphaned the previous poll loop (two loops racing), and a stopped-then-restarted sequencer never cleared the publishers' interrupted flag, so it would build and propose blocks but silently never publish to L1.

Approach

Idempotent, restartable lifecycle. start()/stop() are idempotent across SequencerClient, Sequencer, and PublisherManager, and start() while STOPPING is refused so a mid-stop start cannot orphan a fresh loop. PublisherManager.start() clears the interrupted flag via the previously-unused restart() methods, and SequencerClient.start() starts the publisher manager before the sequencer loop, so publishers are un-interrupted before the first post-restart publish. The funding loop is created once in the constructor and restarted across stop/start cycles, and a start that failed to load publisher state can be retried.

Graceful stop. stop({ graceful: true }) halts the poll loop first, so the in-flight work() iteration and its pending L1 submission complete untouched instead of being interrupted mid-build (which emits a spurious checkpoint-error and drops the enqueued checkpoint). The drain runs before entering STOPPING, since in that state the iteration's own setState calls throw SequencerInterruptedError — which would fail the very iteration being drained. Default stop() keeps the fast interrupting shutdown for production teardown. This replaces the wait-for-IDLE heuristic from #24450, which had a race: sequencers reach IDLE at different times, and any of them could re-enter work() before the stop landed, flaking any test that asserts no sequencer failure events.

No stale sends across restart. The two fire-and-forget fallback sends (vote-and-prune when we cannot build, escape-hatch votes) are tracked, then interrupted and awaited once the poll loop has stopped. A sender sleeping until its target slot therefore cannot survive a stop and publish a stale-slot tx after a restart clears the pooled publishers' interrupted flag: interrupting the wrapper publisher is permanent, since wrappers are never restarted.

e2e primitive + pilot. warpWithSequencersStopped(nodes, warpFn, opts) on SingleNodeTestContext (inherited by MultiNodeTestContext) gracefully stops every sequencer, runs the warp with nobody building, and restarts them (restart: false leaves them stopped). Archivers, provers, and the chain monitor keep running, so clock-driven effects such as an orphan-block prune still fire. Applied to pipeline_prune to collapse its ~2-minute dead wait for the orphan slot's prune deadline: warp two L1 slots into the slot after the orphaned one, and restart the sequencers only once the prune is confirmed. TX_COUNT is unchanged, so assertMultipleBlocksPerSlot and assertProposerPipelining still hold.

Lifecycle calls are assumed to be serialized by the caller (all current callers are); this does not add a mutex for truly concurrent start/stop.

The pipeline_prune speedup is validated by this PR's CI run — the multi-node suite can't be run locally.

[spalladino]

CI root cause + fix (pipeline_prune)

The pipeline_prune recovery test was red, and the cause was not the warp-in-the-past hypothesis (the warp succeeded and the prune fired, block 5→14). The real failure was a 6-minute executeTimeout: every restarted sequencer threw Error: Store is closed on each block-proposal signing attempt:

AztecLMDBStoreV2.transactionAsync
  -> LmdbSlashingProtectionDatabase.tryInsertOrGetExisting
  -> SlashingProtectionService.checkAndRecord

ValidatorHASigner.stop() closed the slashing-protection store, but start() never reopened it (the AztecLMDBStoreV2 instance isn't reopenable), so recovery never made progress after the restart.

Fixed in 9de9057: stop() is now a pause that leaves the store open (matching the restartable-lifecycle model this PR already applies to the sequencer and publisher manager); the store is released on process exit (the node calls process.exit after stopping). Added a red/green LMDB-backed restart test in validator_ha_signer.test.ts that reproduces the exact Store is closed failure and passes with the fix.