feat(attestation-service): report the admission chain status to the operator

[samlaf]

Fixes SEI-279.

getAdmissionChainStatus joins the node-status surface: local reth's genesis block against the manifest's eth.genesis_hash pin, the precondition every admission decision re-checks before reading the on-chain policy. Three answers, because they carry different operator responses:

• matches, with the genesis hash
• genesis_mismatch, with both hashes — the operator's next move is comparing the chain reth booted from against the one the manifest names
• reth_unreachable, with this node's own failed query — expected during the boot tail and across a reth restart, never evidence of a mismatch

The refused joiner keeps getting the class the wire deliberately does not detail: a mismatch denies every join, but only this node's operator can repair it, so the two halves are reported where operators already look rather than in the refusal. The read is strict — one block-0 query, so it never advances the genesis-window latch and cannot change a decision. It is computed per call, never cached: reth comes up after this service, so a node answers unreachable now and matches later without a restart. Every field is public network data (the pin is in the manifest, block 0 on the public /rpc), so an unauthenticated caller learns nothing it could not compute itself.

The admission module's items also stop being public API: everything main wires up (RegistryAdmission, AdmissionDenial, DenialKind, DangerouslyAdmitAnyAzureGuest) is now pub(crate), leaving the RPC traits as the crate's surface.

Unit tests cover the three answers and that the mismatch read leaves the genesis-window latch untouched; the admission integration suite asserts the status on both live denials — a requester-identity denial still reports matches, and a foreign pinned genesis names both chains while healthCheck stays OK.

[linear-code]

SEI-279