Return `headers` as RLP-encoded bytes instead of JSON header objects,
matching the canonical witness format a stateless verifier consumes.
Field type `[]map[string]any` → `[]hexutil.Bytes`; drops
`marshalWitnessHeader`.

Diverges from Geth's `debug_executionWitness` (header objects) —
deliberate, the target is the canonical format.

Corpus (zkevm@v0.4.0): header hashes match (RLP round-trips), 2846/2881,
no regressions. Suite's `rpcHeaderHashes` switches to RLP decode with
#21487.

Stacked on #21532. Refs #20534.

… touches it (erigontech#21565)

`debug_executionWitness` dropped the system address (`0xff..fe`) from
the witness unless it had a state change — the rationale being it's only
ever the `msg.sender` of begin/end-block system calls. But a user
transaction can access it via an account-accessing opcode
(`BALANCE`/`EXTCODESIZE`/`EXTCODEHASH`/`EXTCODECOPY`/`CALL`/`STATICCALL`);
per EIP-7928 that's an account-only entry the witness must carry. Such a
read usually hits the state-object cache (the account was loaded during
the system call), so the `RecordingState` reader never sees it.

Fix: detect the access via the per-transaction access set
(`ibs.AccessedAddresses()`) and keep the system address when a user tx
touched it.

Verified against the EEST zkevm witness suite:
`bal_account_touch_system_address` (all 6 opcode variants:
balance/call/extcodesize/extcodehash/extcodecopy/staticcall) goes green,
full `for_amsterdam` corpus shows no regressions. The zkevm suite lives
on erigontech#21487 until merged, so its CI coverage of this fixture arrives once
that lands. `make lint` clean.

…rom execution witness (erigontech#21569)

## Problem

`debug_executionWitness` emits one extra state node for blocks that
delete and re-insert keys under the same trie branch.

The canonical witness follows insert-before-delete ordering, under which
such a branch never collapses. Erigon's post-state commitment replays
the block's updates in a different order that can transiently reduce the
branch to a single child; the collapse tracer then touches the surviving
sibling into the witness. The block's net change leaves the branch with
>=2 children, so that sibling is not part of the canonical witness.

Surfaced by EEST fixtures
`eip8025_optional_proofs/witness_state_replay_order/*`, which are
constructed to fail a replay that is not insert-before-delete.

## Fix

This does not change the replay order. It restores canonical node
membership with a post-pass filter:

- `CollapseTracer` carries the collapsing branch's nibble prefix
alongside the sibling path.
- After the post-state commitment, `detectCollapseSiblings` reads each
candidate branch from the in-memory commitment domain and drops the
sibling when the branch ended with >=2 children (transient collapse);
siblings whose branch genuinely collapsed are kept.
- Adds `BranchData.ChildCount()` and
`SharedDomainsCommitmentContext.BranchChildCount()`.

Producer-only; no consumer changes, no state-root impact.

## Testing

Verified against the EEST zkevm witness suite (erigontech#21487, which carries the
fixtures): the two `witness_state_replay_order` fixtures pass and the
full `for_amsterdam` run shows no new failures.

Part of erigontech#21307.

…21629)

Adds the zkEVM (canonical) conformance runner for
`debug_executionWitness`, the legacy-mode field population, the optional
`mode` request param, and a format spec.

## Changes

- **`zkevmtest` runner** — a `cmd/evm` subcommand (mirroring
`staterunner`/`blockrunner`/`enginexrunner`) that checks
`debug_executionWitness` (canonical mode) against the
`ethereum/execution-spec-tests` zkevm@v0.4.0 corpus (~22.5k tests). Runs
as the `zkevm-witness-race` shard in the `eest-spec-tests` workflow, not
under `go test`. Known divergences (erigontech#21563, erigontech#21566) are absorbed in the
runner so the shard budget stays 0.
- **legacy `keys`/`codes`** — `keys` holds the 20B address / 32B
storage-slot preimages; `codes` holds pre-state bytecode incl. EIP-7702
designators and the empty-code entry.
- **`mode` request param** (`legacy`/`canonical`).
- **Spec** at `docs/plans/witness-legacy-mode-spec.md`, re-verified
against code.

## erigontech#21487

Carries erigontech#21487's suite plus the fixes that make it pass; erigontech#21487 is
redundant once CI is green here. The open question from erigontech#21487 — whether
a fixture-gated suite belongs in the required race-gate — is resolved:
it's now a `zkevmtest` runner shard in the `eest-spec-tests` workflow
(the erigontech#21092 pattern), not a `go test` package.

## Mainnet legacy soak vs reth-legacy

Rolling soak near tip (block ~`25.25M`, ~3.7k blocks checked):

- 0 health failures — no 500s, no root mismatches; every witness passes
`verifyWitnessStateless`.
- 90.6% strict set-equal on `{keys, codes, state}`.
- Divergences are almost all over-inclusion (204 blocks `keys`, 86
`codes`, 62 `state`) — a few extra nodes per block, still re-executing
to the correct root. 3 blocks show minor `keys`/`codes` under-inclusion,
none affecting `verifyWitnessStateless`.