Stage B: pure-Go WinningPoSt verify (remove filecoin-ffi dep #1)

[Reiers]

Part of #87 (Full Node epic). Approved to start (2026-07-01).

Replace the filecoin-ffi VerifyWinningPoSt call with a pure-Go implementation, removing Rust dependency #1 from the block-validation path.

Why it's feasible (weeks, bounded risk)

• WinningPoSt verify = a Groth16 proof verify over BLS12-381 with Poseidon-hashed public inputs against a registered verifying key.
• Groth16 verify (pairings + MSM) is exactly what consensys/gnark/gnark-crypto do in pure Go — already a Lantern dep for BLS.
• Poseidon over BLS12-381 has a pure-Go impl Lotus already uses (triplewz/poseidon).
• Verify is cheap (ms) and needs only the small verifying keys (MBs), NOT the GB proving params (we never prove).

The hard part: fidelity, not crypto

Must match Filecoin's exact circuit public-input layout, vk encoding, domain separation, and GenerateWinningPoStSectorChallenge bit-for-bit against filecoin-ffi reference vectors. One wrong field ordering = every proof fails.

Tasks

• Scaffold proofs/winningpost package (verify stub + types) — in progress
• Port challenge derivation (GenerateWinningPoStSectorChallenge)
• Assemble public inputs (Poseidon) matching ffi
• Groth16 pairing verify via gnark
• Load/parse the registered verifying keys
• Vector-match against filecoin-ffi reference vectors (calibration + mainnet proof types)
• Wire into the full-node block-validation pipeline behind the F3-trust fallback