fix(sync): skip chain reauth for exact materialized replays

[branarakic]

Summary

• detect exact graph-scoped KA page replays that are already durably materialized
• verify the locally stored assertion identity, confirmation markers, and recomputed V10 content root before using the fast path
• preserve normal on-chain authentication for every new, changed, incomplete, malformed, or mismatched asset

Live evidence

During testnet durable sync, a large page could materialize early KAs and then miss the graph deadline while authenticating a later KA. Because the page checkpoint correctly remained unadvanced, the next attempt authenticated every already committed KA again before reaching the tail. This change makes those exact replays local-store work instead of repeated RPC work.

Security boundary

This is an optimization only. The replay probe requires one immutable root, exact assertion version and graph bindings, trusted local materializedVersion and confirmed markers, and a recomputation of the stored assertion V10 root. Any ambiguity or mismatch falls through to the existing chain-authenticated path.

Validation

• focused materialization and lifecycle tests: 2 files, 36 tests passed
• agent package build: TypeScript, type tests, and package-root test passed
• full unit lane: 139 files, 1,790 passed, 5 skipped, 0 failed
• git diff check passed

Scope

Standalone hotfix based on testnet-canary at 1dba8f5. No node restart, deployment, or branch merge was performed.