fix: authenticate p2p full-state sync responses

[createkr]

fix(p2p): require authenticated signatures for full state sync

Problem

The full-state sync path accepted unauthenticated remote state and merged it directly into local CRDTs.

request_full_sync() built a GossipMessage with an empty signature and passed the remote state into _handle_state() without authenticating the response first. _handle_state() then merged the payload into local attestation, epoch, and balance state.

Because _sync_loop() calls this path regularly, any state sync response could inject arbitrary CRDT values into a node.

Fix

Harden the full-state sync path in three places:

• _handle_state() now rejects empty or invalid signatures before any merge
• _handle_get_state() returns signed state responses
• request_full_sync() verifies the returned state signature before forwarding the payload for merge

Changes

• node/rustchain_p2p_gossip.py

  • require valid signatures on incoming state messages
  • sign outgoing state responses
  • verify state-sync responses in the caller before merge

• test_f1_state_sync_bypass.py

  • regression tests for unsigned rejection, signed acceptance, and blocked exploit paths

Testing

RC_P2P_SECRET=test-secret-for-tests python3 test_f1_state_sync_bypass.py

Compatibility

No schema changes. This only tightens the trust boundary for state sync and preserves the existing signed-message model already used elsewhere in the gossip layer.

[createkr]

For bounty payout, please use RTC wallet: RTC1d48d848a5aa5ecf2c5f01aa5fb64837daaf2f35.