Upgrade EthProofs to Ziren 2.0 and integrate the Fleet app worker

[eigmax]

Upgrade the EthProofs host and guest to the matching Ziren 2.0 graph and let Fleet run the complete EthProofs pipeline beside a dedicated local GPU server. This branch is based on stateless; GOAT changes remain in Fleet's separate compatibility path.

• Lock host/guest Ziren to 0dd65a15, accept structured or RLP-encoded witness headers, preserve untouched storage roots and remove empty accounts. Missing non-empty authenticated storage remains an error. When the execution witness omits bytecode, fetch it at the parent block, verify its hash against the authenticated account, cache it and export it into the guest input.
• Add the integrated worker with persistent, checksummed prepared inputs, committed proof/public-value outputs, an execution cursor and a retryable reporting outbox. Proof failures retain the same input and cursor for restart.
• Keep GPU proving serial. Sequential mode prepares each successive block through a bounded queue and retries that block on witness failure. Optional latest-head mode supports a bounded preparation pool and newest-ready selection, including retry while the witness RPC catches up; production currently runs sequential mode.
• Acknowledge HTTP 409 duplicates only after authenticated cluster/block lookup and exact downloaded proof-byte verification. App-owned outputs and reporting avoid control-host payload transfers.

Validation: 11 worker tests passed, including persistence/recovery, bounded concurrency, out-of-order readiness, same-head retry and duplicate verification. Earlier correctness checks passed 15 trie, three guest storage and two RPC format tests. Release packaging and real local GPU proofs passed with the immutable image resolved from ghcr.io/projectzkm/ziren-gpu:latest on 2026-10-11.

Fleet pins source 85a0c17. The validated guest has SHA-256 334b45b88d6c60e3354e983a5b26ef39b18feee65da828f277a93e646c78c73b, built from fd9589c; subsequent worker-only changes retain that guest identity. The matching GPU image digest is sha256:d4b8ef78d59935d024c034f11f28c26718a1890181f42be2954f31b74e252655.

Production now proves every successive block from its saved cursor with --block-interval 1 --prepare-concurrency 1 --prefetch-depth 1, without --latest-block or nonzero lag skipping. After draining 26,166,879, it published 81 consecutive blocks from 26,166,880 through 26,166,960 on four GPUs and 48 CPUs. Their checksums passed, a downloaded production proof matched local bytes, and the outbox was empty. Historical gaps made under the earlier latest-head policy are not backfilled by this change. The legacy EthProofs client and endpoint are stopped; GOAT is unchanged.

The initial worker is machine-pinned and does not automatically transfer its state or rewind already-published proofs after deep reorgs. Missing bytecode is recovered with hash verification; other incomplete witness data is retried for the same block and still requires diagnosis if persistent.

Bytecode regression validation: all four RPC DB tests pass, including parent-block lookup, cache/export and rejection of mismatched code. Captured block 26,167,642 now passes host execution, state-root validation and native guest verification with 349 code entries (the original witness supplied 348). The release worker builds with the existing guest ELF and GPU image.

Enable reqwest gzip response decoding in the host RPC provider to reduce execution-witness transfer size. Plain JSON responses remain supported. The locked release worker builds on ant-5090-2; the actual provider advertises gzip and passes gzip/plain-response transport checks and a live witness decode. The binary embeds the unchanged registered guest ELF byte for byte.