Fix WIRE-377: generate account-bound finalizer registration proofs

[huangminghuang]

Summary

• Generate the versioned two-proof finalizer registration string in the central producer-registration step.
• Retain standard BLS PoP and add an account-bound signature, checking that the supplied private and public keys match.
• Pin the shared C++/TypeScript vector and test account/key/domain binding, invalid inputs, and orchestration behavior.

Why

WIRE-377 prevents a copied finalizer registration proof from reserving a key for another producer. The companion system contract requires both the standard PoP and a signature over WIRE:sysio.system:regfinkey:v1, the little-endian account value, and canonical public-key bytes. BIOS bootstrap continues using the ordinary PoP; action and SDK types are unchanged.

Validation

• 30 focused tests passed across proof generation, consensus steps, and genesis producer/gate suites against published @wireio/sdk-core@1.0.92.
• Rechecked the 18 proof/consensus tests before publication; all passed.
• The new helper passes a standalone TypeScript check; changed files pass lint.
• Repository build remains blocked by existing SDK slug-type mismatches in unchanged files. The required BLS signing and PoP APIs are available in the published SDK.

Companion PRs

• wire-sysio #656: verifies the two-proof registration format and supplies the CLI generator. Review and land the pair together; deploy the updated contract and matching registration tooling together. No SDK schema release is required.