core: aggregate builder request auths for gloas builders

[KaloyanTanev]

Adds the gloas builder preferences duty (#4724). Partial SignedBuilderRequestAuths from validator clients, received ahead of time via POST /eth/v1/validator/builder_preferences or inline in the v4 block production body, are threshold-aggregated per builder, attached to the proposal's BuilderConfig and submitted to the beacon node. Bumps go-eth2-client to v0.30.1-obol.1-gloas and generalises AggSigDB.Await to take AwaitOpts.

Stacked on #4771. The Eth-Builder-Url round-trip on publish is left for a follow-up.

category: feature
ticket: #4324

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

[codecov]

Codecov Report

❌ Patch coverage is 84.40748% with 75 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (gloas@282a123). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
app/eth2wrap/eth2wrap_gen.go	0.00%	16 Missing ⚠️
core/validatorapi/validatorapi.go	90.26%	11 Missing ⚠️
app/app.go	0.00%	10 Missing ⚠️
core/signeddata.go	72.00%	7 Missing ⚠️
core/bcast/bcast.go	92.10%	6 Missing ⚠️
core/tracker/tracker.go	88.88%	5 Missing ⚠️
core/types.go	25.00%	3 Missing ⚠️
core/aggsigdb/memory.go	92.00%	2 Missing ⚠️
core/fetcher/fetcher.go	95.12%	2 Missing ⚠️
core/tracing.go	0.00%	2 Missing ⚠️
... and 8 more

Additional details and impacted files

@@           Coverage Diff            @@
##             gloas    #4783   +/-   ##
========================================
  Coverage         ?   67.46%           
========================================
  Files            ?      253           
  Lines            ?    33434           
  Branches         ?        0           
========================================
  Hits             ?    22556           
  Misses           ?    10877           
  Partials         ?        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
3.3% Duplication on New Code

See analysis details on SonarQube Cloud

[OisinKyne]

Fixed:

• False "inconsistent partial signed data" reports: builder preferences are now skipped in reportParSigs.
• Inline auth errors: an error forwarding the optional inline auths now logs a warning instead of failing the whole proposal.
• Shared hostnames: every configured builder on the same host now gets its preferences submitted.
• Metric label: the VC-supplied host is capped at 253 bytes and made valid UTF-8. This also fixes a possible crash I'd missed, since the Prometheus client panics on invalid UTF-8 labels.

Still open, none blocking an rc:

1. The 500ms wait per proposal when a builder has no aggregate (fetcher.go:687) is unchanged. It's safe for rc1 because --builder-urls has no default and CDVN doesn't set it, so it only affects operators who opt in. It should still get the "skip if there's no partial" fix plus a metric for builders dropped from proposals before this goes default-on.
2. Metric cardinality: the label is now capped in length, but a misbehaving VC can still create a new series per distinct host it signs. Collapsing unknown hosts to "unknown" (as the tracker does) is the real fix.
3. Ordering: inline auths are still forwarded after randao, so they can arrive after the 500ms wait has started.
4. Spec check: the DOMAIN_BUILDER_REQUEST_AUTH value still needs checking against the pinned builder-specs commit. Worth a quick look before rc1, because the testnet is the first place a wrong value would show up.
5. Lower priority:
   • The mismatch counter counts per submission rather than per proposal.
   • The core_bcast_delay_seconds delay metric is off for this duty.
   • The tracker can't see when one builder failed while another succeeded.