Envelope duty trigger keyed on the local block in Lighthouse block service

[shane-moore]

Tracking issue. No Anchor change planned until the Lighthouse side settles.

Issue

Lighthouse's block service decides whether to run the Gloas envelope step, and which block root to fetch the envelope by, from the block its own beacon node returned before sign_block runs (validator_client/validator_services/src/block_service.rs). For Anchor, sign_block runs QBFT and can return a different operator's block, so the local block and the decided block can disagree on self-build vs external bid.

When an operator's node took an external bid but the cluster decided a self-build block, that operator's Lighthouse never calls sign_execution_payload_envelope (envelope GET 404 at the current pin, deliberate skip once sigp/lighthouse#9948 lands), so it never signs its share. With the leader among at most two self-builders the cluster misses the reveal. Anchor sees nothing: the runner is not invoked.

Bounded: bid-arrival timing tail only (builder definitions are threshold-signed, so configuration cannot diverge), self-build path only, non-slashable, and no exposure until a network has builders.

Fix

Upstream. sign_and_publish_block already holds the signed (decided) block; derive the envelope gate and the fetch root from it after the call. No-op for a plain VC. Raised on sigp/lighthouse#9948: sigp/lighthouse#9948 (comment)

Watch

• Stop external-builder envelope 404 after block publication lighthouse#9948 outcome: if the gate merges keyed on the local block, open the upstream follow-up.
• On the next Lighthouse pin bump, re-check whether the gate and fetch root come from the decided block.
• Same function has an open TODO for routing the envelope fetch through the proposer fallback (--proposer_nodes breaks the fetch today); Lighthouse-side bug, not tracked here.

Context: #1286.