Complete post-centralization contract and service cleanup

[SegueII]

Background

The centralized block sequencer is already live, but L1 batch submission is still coupled to the legacy L1Staking sequencer set, bitmap/BLS inputs, and sequencer-root proof data. The batch submitter must become an independent, slashable role without changing the existing batch, blob, revert, proof, or finalization state machine beyond the explicitly defined authorization and zero-field cutover.

Scope

• Add an upgradeable Submitter contract for batch-submitter registration, self-staking, per-address exit snapshots, withdrawal, and slashing.
• Reuse the existing Rollup staking-address storage slot for Submitter, authorize writes through Submitter.isActive(msg.sender), and record the actual submitter address in BatchData.
• Remove BatchSignatureInput, sequencer bitmap ownership, and ineffective BLS verification from the current Rollup ABI and write paths.
• Preserve the batch-header layout while setting sequencerSetVerifyHash to bytes32(0) after the upgrade.
• Update the prover to use zero in the corresponding public-input preimage position and remove the dedicated L2 Sequencer slot-101 witness read/equality constraint, while preserving post-state-root verification.
• Preserve pre-upgrade Rollup/L1Staking ABIs and exact historical selector decoding; add only the new selectors for methods each consumer already supports.
• Remove tx-submitter rotation, dummy-signature, and legacy sequencer-set dependencies; use explicit batch interval/timeout configuration and Submitter.isActive.
• Update bindings, deployment tasks, common batch code, node derivation, shadow-prove, challenge, gas-oracle, and devnet wiring within these compatibility boundaries.
• Retire legacy L1Staking source/deployment responsibilities only after freezing the ABI and operational records required for historical reads and any separately approved chain operations.

Required behavior

• commitBatch must still reject an index with an existing stored blob hash; it must not require a fresh blob for every batch version or overwrite previously committed blob content.
• After revertBatch, the stored blob hash remains and an authorized submitter uses blobless commitState to resubmit state.
• commitBatchWithProof keeps its permissionless threshold, stored-hash/blob selection, proof verification, and immediate-finality behavior.
• Authorized submissions record msg.sender; permissionless commitBatchWithProof records address(0).
• Submitter withdrawal/removal immediately revokes authorization. Staked exits record that address's current committed-batch index and become claimable once finalized reaches the snapshot; later batches from other submitters do not delay the claim.
• node/core, L1Sequencer, L2 Sequencer/L2Staking state, genesis predeploys, tx-submitter journal semantics, and derivation recovery behavior remain unchanged.
• No pending-batch responsibility counter, fresh-blob replacement path, canonical source resolver, static validator migration, new journal/data-directory model, or signer failover is introduced.

Acceptance criteria

• Submitter registration, staking, active-state changes, exit snapshots, claims, transfer failure, and slashing are covered by contract tests.
• Rollup storage compatibility, atomic initialize4 cutover checks, submitter attribution, challenge economics, and all three submission paths are covered by regression tests.
• Old/new selectors are calculated from their ABIs and fixed historical calldata fixtures remain decodable by the consumers that already support those methods.
• Header and prover public-input hashing agree on the zero field; slot-101-specific witness handling is removed without weakening post-state-root verification.
• tx-submitter preserves stored-hash-driven commitBatch/commitState selection, pending-transaction rebuild behavior, and the existing journal format.
• node/core has no functional diff, and L2 contracts/genesis retain the interfaces and state required by existing nodes.
• Builds, tests, lint, storage-layout checks, ABI archive verification, reproducible prover artifacts, and required fixtures pass for every modified module.

Release and cutover gates

This issue implements repository support; it does not execute or authorize the production upgrade. Before cutover, operators must separately provide evidence for:

• a stable-L2-block snapshot and final recheck of batchBlockInterval and batchTimeout for working and backup instances;
• terminal old-ABI journal entries and no pre-upgrade sealed cache entry above the cutover finalized index;
• global Rollup drain, no active challenge, and no revert request;
• a decision for the final pre-upgrade shadow batch, which the current one-batch-lag query cannot obtain after writes stop;
• reproducible SP1 Docker build, matching ELF/program vkey, main/shadow verifiers, and PLONK fixtures;
• a state-fork/staging rehearsal covering atomic ProxyAdmin upgrade, first post-upgrade commit, proof, and finalize;
• explicit acceptance of the existing commitState consumer limitation (derivation, challenge, shadow-prove, and gas-oracle do not add support in this change);
• a separate decision for fresh-network/devnet L2Staking.OTHER_STAKING, which must not be filled with the new Submitter or a dummy address;
• a separate safety assessment before any legacy L1Staking withdrawal/removal message that could delete L2 data still used by node/core.