Repro: poller never backfills below its first head on an empty store (all node roles)

[dazthecorgi]

Adds repros for a bug where the global frame poller never backfills below its first head on an empty store.

I tried to fix it, but the fix ballooned and I realized I don't understand the protocol & the codebase well enough to confidently ship a fix, so I thought it'd be better to just add a repro and pass it on to you @CassOnMars .

I found the bug using the devnet crate which is currently broken in .25, because it needs changes to libp2p which is no longer vendored. I added the vendored libp2p back and fixed devnet it in this branch: https://github.com/dazthecorgi/monorepo/tree/devnet-app-shard. So you can run crates/devnet/test.sh there to repro the issue if you want using production nodes.

LLM write up of the bug and the repros below.

---

The global-frame poller's forward-fill guard

if config.forward_fill && last_frame > 0 && new_number > last_frame + 1 {

treats an empty store (last_frame == 0 — every fresh boot) as "nothing to fill": the first successful head poll stores ONLY the head frame, fires on_frame for it, and latches last_frame = head. Frames 1..head-1 are never fetched, and no runtime path revisits frames below the cursor (the record-gap scan runs at bootstrap only), so the hole is permanent and the serial materializer wedges below it.

This is NOT archive-specific. master_node/archive_sync.rs sets forward_fill: true for EVERY node role — deliberately, because regular nodes need contiguity too: their app-shard storage attestations anchor ρ_N to an exact global frame that must be present in the local clock store ("anchored global frame unavailable for ρ_N" when it is not). Regulars only shrink the window (gossip stores frames independently; a far-behind boot state-jumps): a client whose store is empty at its first head poll while gossip missed the early frames — boot-time partition, late-forming mesh, gossip drops — hits the identical skip with the identical consequences. Archives, with no gossip arm and no state-jump, hit it deterministically.

Observed live in the devnet partition harness: an archive isolated while frames 1-2 finalize returns NotFound for them forever, failing the terminal committed-range safety check ("safety fetch incomplete — ready nodes could not serve their committed range").

This commit adds an in-process repro and NO fix:

• frame_sync: extract the poller's fetch surface into PollerFrameSource (impl'd by ArchiveClient) and split run_archive_poller into a thin mTLS wrapper over run_archive_poller_with_connector, so tests can inject an in-process source. The loop body is unchanged; the public signature and the sole production caller (master_node/archive_sync.rs) are untouched.
• forward_fill_repro::empty_store_first_head_poll_must_backfill_full_history (archive mode, gossip_freshness: None) drives the REAL poller loop over a fresh Rocks store against a fake archive serving frames 1..=5 and asserts contiguity — FAILS on this branch (only frame 5 is stored; on_frame saw [5]).
• forward_fill_repro::client_mode_empty_store_hits_the_same_skip (regular-node mode, gossip_freshness: Some with a quiet mesh) — FAILS identically, proving the guard is role-independent.
• forward_fill_repro::seeded_store_gap_is_forward_filled is the passing contrast: the same gap above a NON-empty cursor (store holds frame 1) is filled correctly — the empty-store case is an inconsistency in the guard, not a designed limitation of the loop.

Deleting last_frame > 0 && from the guard turns both repros green (verified locally), though a production fix likely wants a bounded initial fill rather than an unconditional genesis-to-head crawl.