feat(protocol)!: seed protocol contract registration nullifiers at genesis

[spalladino]

Motivation

Root-cause fix for A-1257, complementing the archiver-resilience fix in #24227. Nodes preload every bundled protocol contract class/instance at synthetic block 0, but world-state genesis seeded no matching registration nullifiers. That gap made a first on-chain ContractClassRegistry.publish of a bundled protocol class id protocol-valid, which then collided with the archiver's block-0 preload and stalled L1 sync. Seeding those nullifiers at genesis rejects the re-publish at the protocol level (duplicate nullifier), so it never reaches the archiver at all.

Fixes A-1264

Approach

Pre-insert the protocol contracts' registration nullifiers into the genesis nullifier tree. For each of the three protocol contracts we seed two siloed nullifiers:

• the class nullifier siloNullifier(ContractClassRegistry, classId) — matches what ContractClassRegistry.publish emits;

• the instance nullifier siloNullifier(ContractInstanceRegistry, magicAddress) — uses the magic protocol address (1/2/3), consistent with the node's block-0 instance preload.

• C++ world-state gains a prefilled_nullifiers input, threaded through the WorldState constructors, the napi binding, and create_canonical_fork, which inserts them as the nullifier tree's initial leaves. The indexed tree requires its initial leaves to be unique and strictly increasing, so the seeded list is sorted ascending (and a defensive check enforces this before the C++ call).

• GenesisData.prefilledNullifiers is a required field. EMPTY_GENESIS_DATA (truly empty) is retained for low-level tree tests; a new canonical DEFAULT_GENESIS_DATA (in @aztec/protocol-contracts, which can see both the type and the generated nullifier list) carries the protocol nullifiers and is now the default in all production world-state constructors. GenesisData stays in @aztec/stdlib, which cannot depend on protocol-contracts (circular), so the default is applied one layer up.

• The seeded set changes the genesis nullifier-tree root, hence the genesis block header hash and archive root. Both constants were recomputed authoritatively by seeding the same nullifiers in the C++ WorldStateTest.GetInitialTreeInfoForAllTrees and reading the result, then propagated to every location that pins them: constants.nr, constants.gen.ts, ConstantsGen.sol, aztec_constants.hpp, the V5 deploy script, the mainnet_compatibility test, and the regenerated L1 checkpoint fixtures.

Breaking change

This changes the genesis state root. It applies to new networks only — an already-deployed chain has the old genesis archive root committed to L1 archives[0] and cannot adopt the new one. Coordinated genesis migration is required for any redeploy.

Validation

• C++ WorldStateTest genesis tests pass with the recomputed roots; @aztec/world-state native tests 50/50.
• New e2e protocol_class_publish.test.ts: re-publishing a bundled protocol class is rejected as a duplicate nullifier. The protocol instance path is documented as unreachable on-chain (publish emits the derived address; no tx can have a magic address as msg_sender), so it is not separately testable.
• L1 checkpoint fixtures regenerated; forge test on their consumers passes (69/69).
• Fixed an napi argument-index collision uncovered once the module was loadable (the map_size/thread_pool/ephemeral indices had to shift to 7/8/9 after inserting prefilled_nullifiers at index 4), which otherwise broke every NativeWorldState constructor.

Changes

• barretenberg (world-state, napi, wsdb, constants): prefilled_nullifiers plumbing + recomputed genesis constants; standalone wsdb IPC documented as non-production (seeds empty nullifiers).
• noir-protocol-circuits / constants / l1-contracts: regenerated GENESIS_ARCHIVE_ROOT / GENESIS_BLOCK_HEADER_HASH; V5 deploy script and 6 checkpoint fixtures updated.
• stdlib: required prefilledNullifiers on GenesisData.
• protocol-contracts: generated ProtocolContractGenesisNullifiers + DEFAULT_GENESIS_DATA.
• world-state: prod defaults switched to DEFAULT_GENESIS_DATA; seeded-nullifier wiring + ordering guard.
• tests: new e2e + updated genesis literals.