Require eligible producers for finalizer key registration

[huangminghuang]

Summary

• Require producer_rank::is_eligible_operator before regfinkey accepts a finalizer key: the producer row must be active and its operator must have ACTIVE producer status.
• Cover unregistering, administrative removal, reactivation, operator termination, and cleanup of previously registered keys.
• Regenerate the system-contract WASM with unchanged ABI and standard proof-of-possession format.

Why

A producer row can remain after it is deactivated or loses operator eligibility. Checking only that the row exists lets that account continue reserving finalizer keys.

This implements the narrower guard requested in Heifner's review. WIRE-377 remains closed by risk acceptance: cross-account proof replay between eligible producers is still possible. The predicate permits first-key registration and does not restrict deletion of existing keys after eligibility is lost.

Validation

• 32 JIT cases passed across sysio_system_finalizer_key_tests, sysio_producer_eligibility_tests, and getpeerkeys_tests; 2,297 assertions.
• Native/CDT contract build passed; regenerated WASM matches the tracked artifact and ABI is byte-for-byte unchanged.

[heifner]

LGTM. This is the check I asked for: regfinkey now needs an active producer row and an ACTIVE producer operator, cleanup through delfinkey stays open, and the tests cover unregprod, rmvproducer, re-registration, and termination.

Optional: regfinkey reads the producer row twice (contains, then get); a single try_get would do.