feat: enforce the circuit verification key registry

[jpraynaud]

Content

This PR includes the enforcement of the circuit verification key registry prepared in #3513:

• Enforce the certification of the circuit verification keys in MithrilCertificateVerifier for the Snark and IvcSnark aggregate signature types, on both the standard and the full chain shortcut paths, with a mandatory certifier
• Resolve the registry of the client's Mithril network in mithril-client through the published networks.json by matching the aggregator endpoint, enabled by default
• Add the unstable --circuit-verification-key-registry-path parameter to the client CLI to read the registry from a local file (tests and local deployments)
• Enforce the registry in the aggregator at certificate creation and chain synchronization: the new circuit_verification_key_registry_url parameter selects the registry source, downloaded at every hourly refresh (a file:// URL reads a local file), the certificates requiring the registry being rejected without a source
• Generate and enforce the registry on the fly in the end to end tests at genesis bootstrap
• Adapt the infrastructure and CI to support the registry
• Add the circuit verification key registry runbook

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested

Issue(s)

Relates to #3148

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Test Results

     5 files  ±0     222 suites  ±0   54m 0s ⏱️ + 10m 59s
 3 724 tests +3   3 724 ✅ +3  0 💤 ±0  0 ❌ ±0 
11 934 runs  +3  11 934 ✅ +3  0 💤 ±0  0 ❌ ±0 

Results for commit eaef674. ± Comparison against base commit c6f2e05.

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

Unresolved critical, moderate, and nit findings remain across configuration, cache enforcement, registry publication, and test coverage.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

mithril-client/src/circuit_key_registry.rs:39

• This is an Option, but without default serde treats the field as required. The checked-in networks.json currently omits this property, so filter_map(...ok()) drops each entire Cardano environment instead of retaining networks without a registry; even a mixed old/new configuration cannot be resolved. Make the optional field default to None.

    #[serde(rename = "circuit-verification-key-registry")]
    circuit_verification_key_registry: Option<UrlReference>,

mithril-client/src/circuit_key_registry.rs:15

• with_circuit_verification_key_registry_retriever is a public customization API, but this module only privately imports CircuitVerificationKeyRegistryRetriever and the public types in its method signature. Downstream library users cannot name or implement the trait without adding the internal registry crate as a direct dependency. Re-export the trait, retriever error, and signed-registry types from this public module.

use mithril_circuit_key_registry::{
    BoundedHttpDownloader, CircuitVerificationKeyRegistryRetriever,
    CircuitVerificationKeyRegistryRetrieverError, SignedCircuitVerificationKeyRegistry,
};

• Files reviewed: 32/33 changed files
• Comments generated: 6
• Review effort level: Lite