fix(forkchoice): derive finalized from canonical head, not an independent max

[GrapeBaBa]

Problem

Fixes #1000.

on_block advanced store.latest_finalized by an independent monotonic max over every imported block's post-state, decoupled from store.latest_justified and the head. A fork that finalizes a higher slot but then loses head selection left its finalized checkpoint latched in the store, so store.latest_finalized could sit on a dead branch that is not an ancestor of the head, while head / latest_justified were on a different branch whose state finalized is lower.

get_attestation_target decides target justifiability against store.latest_finalized, while process_attestations validates targets against the canonical head-state's (lower) finalized. Once the two finalized slots diverge, is_justifiable_after disagrees, every advancing target is rejected, and finalization freezes — first observed as a network-wide finalization freeze in a long-running multi-subnet devnet.

The original forkchoice store (#53) and the 3sf-mini reference derive finalized from the chosen (head) state; #194 changed it to the independent max (see #1000 for the full root-cause trace).

Fix

Derive store.latest_finalized from the canonical head's chain after head selection:

• take the finalized slot named by the head's state, and
• recover its root as the head's own ancestor at that slot.

finalized_slot = store.states[store.head].latest_finalized.slot
finalized_root = store.head
while store.blocks[finalized_root].slot > finalized_slot:
    finalized_root = store.blocks[finalized_root].parent_root
store = store.model_copy(
    update={"latest_finalized": Checkpoint(root=finalized_root, slot=finalized_slot)}
)

The checkpoint then always lies on the head chain (a fork that loses head selection cannot pin its finalized), and crucially store.latest_finalized.slot == head-state.latest_finalized.slot, so the slot a validator attests against matches the slot the state transition validates against — the desync that froze finalization is gone. This matches 3sf-mini, where the finalized checkpoint is read from the chosen head's state.

Taking the root as the head's ancestor (rather than copying head-state.latest_finalized.root) also recovers the correct root for a checkpoint-sync anchor: a state can never name its own block as finalized, so the anchor state carries a placeholder root while the head's ancestor at the anchor slot is the real anchor block.