Split prove proxy into user and system roles

[hellojason3]

Summary

• Split native prove-proxy RPC assembly and circuit/provider initialization into user, system, and all roles. The CLI defaults to user; local development explicitly opts into all.
• Add psy_get_prove_proxy_role with explicit user/system capability flags. A role does not initialize or register the other proof family.
• Add system_prove_proxy_url to network configuration. Route relayer bridge proving to that endpoint and verify system capabilities at startup, with no fallback to the user pool.
• Keep shared proof types, update RPC documentation, and add role/configuration validation tests.

Source head: 3a81f59e0cf9333fc2ad4aefda7c83787660c9ab.

Scope

This PR contains runtime code, tests, RPC documentation and the local developer launcher adjustment. GCP/offsite deployment scripts are maintained separately on deploy/multi-chain-gcp (merge commit 05775a55) and are not part of this PR. No RPC keys, private keys, or compiled binaries are included.

Breaking Configuration / Rollout

• Explicitly run --role all to retain a single-process service for both families. A bare new prove-proxy invocation serves the user family only.
• With two processes, point wallets/faucet at user, and set the relayer's system_prove_proxy_url to system (or a deliberately shared all instance).
• Verify proxy capabilities before upgrading the relayer. Older proxies without the capability RPC cannot satisfy its startup check.
• The staging deployment uses two independent systemd processes on arc99x3, with private gateway/WireGuard forwarding. This is role separation, not dispatcher/worker job distribution.

Verification

• Re-run on the PR head: cargo test --locked --offline --release -p psy_prover --test prove_proxy_role: 5 passed, 0 failed. Covers user-only/system-only/all registration, constructor laziness, constructor errors and role metadata.
• Native Arch proxy and Debian Bookworm relayer artifacts were built and deployed from this source revision.
• Staging, 2026-09-15: separate user/system PIDs, correct role responses through the private gateway, and opposite-family methods returning -32601.
• Public prove endpoint reports user; relayer logs system prove proxy verified against the private system endpoint.
• Real bridge aggregation completed on the split system process. Checkpoints 58476-58507 were finalized on Sepolia, BSC Testnet and Base Sepolia. Proof RPC wall time was about 15.4 seconds.
• Deployment-side checks (separate branch): strict capability gates, shell syntax/ShellCheck for rollout scripts, multichain profile consistency and build-source forwarding passed.
• This verification was not a fresh registration/faucet/private-transfer/deposit/withdrawal E2E run. Existing compiler warnings remain; they are not claimed fixed here.

Merge Blocker: psy-genesis Gitlink

multi_chain advanced psy-genesis to 9ea96ca13f60247c22b2108f086fb9cd1287ba94, which updates contract artifacts. This branch points to 285d9a2a82e20ae20053f81345537abba23136a1, which adds system_prove_proxy_url to config.json on top of 628e2fc without changing contract artifacts.

A merge preview reports a psy-genesis submodule conflict. Before merging, reconcile the configuration addition with the newer genesis branch and update the gitlink to the agreed combined commit. Do not resolve it by discarding the newer contract artifacts or by silently reverting the system endpoint configuration. That combined dependency revision has not been validated by the staging evidence above. The currently running network's genesis was not changed.

Operational Notes

• Alchemy monthly quota exhaustion was an independent staging blocker and was resolved by an RPC subscription change; role splitting does not fix quotas.
• Restarting the relayer while a finalize transaction is pending can produce already known / InvalidCheckpointContinuity retries until the next round refreshes the L1 cursor. Staging recovered without database edits; this PR does not claim to fix that retry behavior.
• Separate roles reduce unnecessary initialization but do not establish a hard memory limit or prove safety under arbitrary concurrent proof workloads.