…ainst extension-only split

Two coupled fixes for the EXPB sparse-vs-Patricia mismatch:

1. MultiProofReader: when walking through an Extension, ALWAYS load the
   underlying Branch and include it in the proof — not just when a target
   fully matches the extension's shortKey. This is required for the
   absence-at-extension case where an update partially matches the
   prefix then diverges, triggering a split. The split needs to know
   the inner Branch's content to encode the existing extension+branch
   correctly as a child of the new wrapping branch.

2. SparseSubtrie.UpdateAtBranch: detect extension-only state
   (stateMask == 0 with non-empty shortKey, meaning the inner Branch
   was revealed by hash only) and return NeedsProof so the retry loop
   fetches a proof that materializes the inner Branch. This is a safety
   net for any edge case where fix #1 doesn't apply.

Root cause from EXPB diagnostic: at depth ~7, sparse produced inline
'D1 80×17' (an empty Branch RLP) where Patricia had a real 32-byte
hash. The empty Branch came from SplitExtensionAndInsert truncating
the shortKey of an extension-only BranchWithExtension whose inner
Branch was never revealed (stateMask=0).

…plit result

Two related fixes for the retry-loop stall at block 22360144 (non-USDT
account 0x4a29406e...). EXPB diagnostic showed: 1 stuck update target,
isDelete=False, TryFindBlindedEntryOnPath returns false (no boundary on
path), TryFindBlindedSiblingForDeletion returns false. UpdateLeaves
keeps reporting NeedsProof but the retry loop can't find anything to
fetch — so it loops 10 times and throws.

Root cause #1: UpdateAtBranch's pre-recursion check returned NeedsProof
for ANY non-delete update hitting an extension-only node, including when
the update's path DIVERGES inside the extension's shortKey. That diverge
case can be split LOCALLY without revealing the inner branch — the
original extension just gets a shorter shortKey, its blinded child
reference stays intact, and a new leaf joins via a new parent branch.
Now the pre-check only requests a proof when the path matches the full
shortKey (continuing INTO the inner branch).

Root cause #2: SplitExtensionAndInsert can shrink an extension's
ShortKey to empty (commonLen+1 == extensionKey.Length). The current
code sets ShortKey = null, leaving a degenerate node: Kind=Branch,
StateMask=Empty, ShortKey=null, one orphaned blinded child slot.
HashNode's extension-only check requires HasShortKey, so this falls
through to EncodeBranch and emits a 17-element empty branch — wrong.
Fix: when ShortKey would become empty, promote the blinded child
reference directly into the new parent's child slot at existingNibble
and free the degenerate node.

…GetCacheSize)

Analysis of the cross-block sparse cache (PreservedSparseTrie) showed it works
near-optimally for its job: block #1 cold-reads the full proof (proof=26ms,
1818 nodes), block #2+ are warm (proof=0-1ms) because hot paths stay revealed.
Warm sparse root computation is 1-3ms/block.

The catch is SIZE. With pruning off by default, SparseStateTrie._storageTries
grows one SparsePatriciaTree arena per contract ever touched and only evicts on
reorg/clear — unbounded retained memory on a long-running node. Prune is the
bound (it drops cold contracts and prunes cold slots) but it's disabled by
default, and until now there was no way to even observe the growth.

Adds cheap, allocation-free size reporting:
  - SparseSubtrie.ArenaHighWater / SparsePatriciaTree.ArenaHighWater: arena slot
    high-water mark, a monotonic proxy for retained footprint.
  - SparseStateTrie.GetCacheSize(): (storageTrieCount, accountArenaNodes,
    storageArenaNodes). storageTrieCount is the value that grows unbounded.
  - FlatWorldStateScope logs the cache size at Debug on each anchored commit,
    tagged with whether pruning is on.

This is the prerequisite for safely enabling a bounded cache in production: you
can now watch the retained set and size the prune caps to a memory budget. No
behavior change to root computation; metrics only.

Note: profiling established the sparse trie is NOT on the EVM execution read path
(EVM reads go WorldState -> PersistentStorageProvider -> SnapshotBundle -> RocksDB),
so warming the sparse trie cannot reduce execution-time storage reads — it only
saves proof reads, which the cross-block cache already drives to ~0. The
remaining DB-read cost lives in a separate subsystem.

Tests: 521 + 432 green.

…nchmarks runner

Fixes from smoke run #1 and adversarial review:
- flood: pin uv tool env to Python 3.10 (pyarrow 12.0.1 has no cp313 wheels),
  use 'flood print' for the text summary, fail-fast vegeta download
- stop-node: stop before capturing logs so shutdown-phase exceptions are scanned
- quality gate now fails the job when the tool step (continue-on-error) failed
- fingerprint: typed listing with mode/owner, loud failure on partial listings,
  cross-run anchor persisted after clean verify
- path safety: canonical (symlink-proof) guards + input shape validation in
  resolve; defensive cleanup moved to guarded cleanup.sh; reap stale containers
  by name prefix; never rm -rf while mounts remain underneath
- EthCallChaos: camelCase JSON fields in jq, corpus from corpus-v1 release asset