fix(evm): make public-parameters setup actually endorsable

[atharrva01]

Part of #2412 (items 1, 2, 6, 8).

SetupPublicParams sent raw public-parameters bytes through the same validator a token request goes through, which can never succeed since those bytes aren't a marshalled token.Request. Adds a SetupDeltaFactory that validates and signs a setup delta directly, without needing an existing TMS (needed for first-time setup, where there is no TMS yet to resolve a validator from).

Two related bugs came out of the same review round:

• the delta's public-parameters CAS check reads the chain at latest, but the local watcher was polling at the finality tag, so every ordinary approval got refused for the whole finalization window after a setup update. The watcher now reads at latest too.
• NewApprovedEnvelope never set Namespace, so an envelope built through it can't be broadcast. RequestApproval and SetupPublicParams now both go through it instead of duplicating the struct literal (which is how the two silently diverged in the first place).

Also adds a startup check that an endorsing node's own address is actually one of the configured endorsers, instead of starting cleanly and silently signing endorsements nobody's registry recognizes.

Test plan

• go build / go vet clean for x/token/services/network/evm and the two SDK wiring packages
• go test ./... green, including new tests for the setup dispatch, the watcher block tag, and the endorser address check
• docs updated (network-ethereum.md, network-ethereum-internals.md, network-ethereum-deployment.md)

[atharrva01]

hi @Effi-S, pushed the fix, PTAL

[Effi-S]

Hi @atharrva01,
Thank you for the work here.
Please squash to 1 commit and rebase.

[atharrva01]

hi @Effi-S, pushed fixes for the watcher gating and the boilerplate nit, and dug into the setup-hash question, replied with what I found. Also squashed to one commit. PTAL

[Effi-S]

@atharrva01 - Looking Good, Some minor changes.

[Effi-S]

Low:

bind only checks delta.Anchor and delta.Validate(). It ignores req.Kind. For a
KindSetup request the initiator sent PublicParamsRaw itself, so it can cheaply assert both
delta.IsSetup and delta.SetupParameters == req.PublicParamsRaw with no validator — unlike
TokenRequestHash for approvals, which the comment correctly explains it cannot reproduce.

As written, a quorum that returned a delta with different SetupParameters (or a non-setup
delta IsSetup=false) would still pass bind, assemble, and be broadcast — the node would
commit public parameters it did not request, or silently commit nothing. This needs a malicious
or buggy quorum (full quorum compromise is already out of scope), so it is defense-in-depth, not
an exploitable hole. But it is a request-local, validator-free check the setup path uniquely
allows, and worth adding.

Nit:

• responder.go endorse: factory = f stores a concrete *SetupDeltaFactory into the
  deltaBuilder interface. If a future setupFactoryFor ever returned (nil, nil),
  factory.Build would panic on a typed-nil. Current production/test wiring never does this.
• A node with Endorser.Enabled=true that fails to register (e.g. the "one endorsing network
  per node" refusal in registerEndorser) still gets latest reads on its watcher, taking
  reorg exposure without the endorsement benefit. Harmless and self-healing; edge case only.

[atharrva01]

@Effi-S , PTAL

[atharrva01]

hi @Effi-S, pushed c9609a8 (squashed to one commit, rebased onto main). endorse() now has an explicit KindApproval case with an error default, the watcher takes the endorsing namespace's config when namespaces share a TokenState so a slower non-endorsing one can't stretch the poll interval, and SetupDeltaFactory.Build checks the anchor before the validator and the chain read. Added tests for the last two. PTAL

[AkramBitar]

@atharrva01

Could you please fix the lint ?

Regards,
Akram

[atharrva01]

pushed f3bdfb8 (still one commit). @Effi-S: the watcher now takes the shortest pollInterval among endorsing namespaces sharing a TokenState, Validate rejects a request carrying the other kind's field, and bind guards a nil request. Tests added for the first two. @AkramBitar: the lint failure was a test of mine tripping testifylint (assert vs require), fixed, golangci-lint is clean locally on the evm module. The CI run also printed govulncheck findings in grpc and libp2p, in code this PR doesn't touch, so those would need a dependency bump separately. PTAL