fix(network): enforce checkpoint-safe block apply budget

[evan-forbes]

Motivation

The post-stack audit found one portable runtime safety gap from evan/perf-plus-download-fixes: the block-sync apply window and byte budget need to be large enough to submit one full checkpoint range plus the resolving checkpoint block. If the configured budget cannot hold that range, checkpoint verification can stall below the boundary because no submitted body becomes durable and no body bytes are released.

Solution

• Raise DEFAULT_BS_MAX_SUBMITTED_BLOCK_APPLIES from MAX_CHECKPOINT_HEIGHT_GAP to MAX_CHECKPOINT_HEIGHT_GAP + 1.
• Clamp the effective submitted-apply limit to that checkpoint-safe floor even when serialized config provides a smaller value.
• Add BS_CHECKPOINT_RANGE_BYTE_FLOOR validation for max_inflight_block_bytes.
• Refresh the v5.0.0-rc.4 config fixture to serialize max_submitted_block_applies = 401.

Scope boundary: this intentionally does not port the later Committer/apply-queue split or benchmark tooling.

Tests

Passed locally on codex/block-sync-checkpoint-byte-floor-pr:

• cargo fmt --all -- --check
• cargo test -p zebra-network zakura::block_sync --lib (146 passed)
• cargo test -p zebra-network p2p_v2_block_sync_config_validation_rejects_degenerate_values --lib

Attempted but blocked before test execution by the local RocksDB C++ build issue:

• cargo test -p zebrad --test acceptance latest_config_is_stored -- --nocapture
• Blocker: librocksdb-sys fails compiling RocksDB headers where uint64_t is used without <cstdint>.

Specifications & References

Stack context:

• Base: fix(network): tune block sync throughput defaults #289 / review/blocksync-throughput-defaults

AI Disclosure

• No AI tools were used in this PR
• AI tools were used: Codex was used to audit the remaining branch gap, port this focused follow-up, run validation commands, and draft this PR description.

PR Checklist

• The PR title follows conventional commits format: type(scope): description
• The PR follows the contribution guidelines.
• This change was discussed in the block-sync follow-up audit context.
• The solution is tested as described above.
• The documentation and changelogs are up to date.

[evan-forbes]

Pre-split backup note before rewriting this PR:

• Current fix(network): enforce checkpoint-safe block apply budget #292 head: cfef29dac5011f121429afbfc36ae8ed350839d4
• Current fix(network): block-sync stack review follow-ups #295 head: c8db64e0219cd07590a9658e3d8491c660bbd1a4
• Backup branch for the old fix(network): enforce checkpoint-safe block apply budget #292 head: backup/pr292-before-split-20260628

#295 is intentionally left unchanged.

[evan-forbes]

Additional pre-split backup note: #292 advanced from cfef29dac5011f121429afbfc36ae8ed350839d4 to 7a3f1860142447ae18d41382b7d88a4c4504e0ec before the force-update attempt. That newer tip is now backed up at:

• backup/pr292-before-split-20260628-7a3f186

The original cfef29d... backup remains at backup/pr292-before-split-20260628.