Guard against full exit overwriting same-batch partial withdrawal

[cyc60]

Description

The greedy full-exit loop in _get_withdrawals had no guard against a validator already present in the withdrawals dict. A compounding validator can be assigned a partial withdrawal by the mid-loop top-up and also appear later in the exit order; a subsequent iteration would then overwrite the partial amount with Gwei(0) — silently converting the partial into a full exit — while queued_assets had already been decremented for both the partial amount and the full balance, under-requesting the remainder.

With the partial-capacity accounting fixed (#796), the top-up always saturates the remaining queued assets and the loop terminates before this can happen, so the overwrite is not reachable through normal inputs today. This guard is defense-in-depth: correctness currently rests on the unenforced "top-up always saturates" invariant, and any future change to the top-up gate, exit ordering, or partial-allocation policy would silently reintroduce a fund-affecting bug. The regression test forces an under-saturating allocation via a patched _get_partial_withdrawals to pin the boundary independently of that invariant.

Stacked on #797.