Feat/remove relayer layer

[nol4lej]

Summary

Removes the EVM relayer layer. A validator is now its account and session keys, nothing else. Private spends are submitted unsigned only, and every spend fee and EVM priority tip goes to the validator that authored the block. Builds on the spec 19 block-author fix.

Why

• The app already submits every spend unsigned (gasless; the ZK proof is the only authorization). Nobody committed to relays, so every fee already went to the block author. The relayer machinery (register_relayer, the evmr key, relay commits, orbinum_relayShieldedCall) was unused in production, and it had bugs.
• An EVM-signed spend (the precompile path) permanently links the signer's address to the spend's nullifiers.
• EVM priority tips were paid to an H160 taken from Aura key bytes. No key controls that address.

Chain (pallet-shielded-pool 0.25.0, precompile 0.10.0, runtime-api 0.4.0)

• private_transfer and unshield accept only an unsigned origin; signed and Root fail with BadOrigin.
• Fee ledger: new PendingFees(validator, asset), credited to the block author (Config::BlockAuthor) on every spend, with a FeeCredited event. The floor is the constant MinSpendFee (0.001 ORB).
• Calls: call 19 claim_relay_fees → claim_fees(asset_id, amount), signed and paid to the caller (FeesClaimed). Call 18 commit_relay is retired.
• Removed: the Relayed origin, ensure_spend_origin, relay op hashes and the pallet-relayer dependency.
• try_state: pending native fees never exceed the pool ledger.
• Precompile 0x…0801 keeps only shield. privateTransfer, unshield, commitRelay and claimRelayFees revert with retired in spec 19: submit spends unsigned via Substrate.
• ShieldedPoolRuntimeApi v5: relay_config and relay_commit_hash removed.

Runtime (orbinum-runtime 0.5.0, spec 19, tx 7)

• pallet_relayer removed. Index 16 is retired, and RelayerRuntimeApi and its benchmarks are gone.
• EVM tips: TipToValidator pays a transaction's priority tip to pallet_authorship::author(), the validator account, and burns it when there is no author. block.coinbase is 0x0: no H160 maps onto an sr25519 validator account.
• pallet_validator_set::OnValidatorRemoved = ().
• Migrations:
  • RelayerFeesToPool drains Relayer::PendingRelayerFees into PendingFees. A balance held by an Aura key is re-keyed to the validator that owns the key.
  • RemoveRelayerPallet clears the rest of the Relayer prefix.
  • MoveStrandedEvmTips moves each Aura-derived coinbase balance to the validator owning that key.

Node (orbinum-node 0.5.0)

• Removed the relay RPC (orbinum_relayShieldedCall, orbinum_relayerStatus), the relayer RPC (relayer_*, relayer_getRelayInfo), the evmr keystore key and EthValidatorSigner.
• ISMP/Hyperbridge is untouched.

Weights

private_transfer, unshield, claim_fees and remove_validator were adjusted by hand: they no longer count the removed relayer storage, and the spends now count the block-author lookup. Their time and proof-size terms still over-estimate until the next benchmark run (noted in each file header).

Testing

• Unit tests: pallet-shielded-pool 384 (393 with benchmarks), precompile 40, orbinum-runtime 54, pallet-validator-set 60, fc-rpc 48, pallet-ismp-messaging 86.
  • New runtime tests cover: the author is the session validator; fees reach the validator account; each migration moves only owned keys and is idempotent; the relayer prefix is cleared; an EVM tip goes to the author or is burned.
• clippy -D warnings, cargo check with runtime-benchmarks,try-runtime, full node build.
• Local 2-validator network, real traffic:
  • One validator's account ≠ its Aura key.
  • Node 0.4.0 on spec 18 ran 6 shields, 4 transfers and 2 unshields with real proofs. The fees landed on that validator's Aura key, and the EVM tips on Aura-derived accounts.
  • Then: new binary → setCode → spec 19, tx 7.
  • Results:
    • fees moved to the validator, and stranded tips to their validators;
    • the Relayer prefix is empty;
    • there are no relayer_* RPCs;
    • spends with the current app SDK land, and each FeeCredited names the author;
    • claim_fees pays from the real pool ledger;
    • a signed spend fails with BadOrigin, and the precompile's privateTransfer reverts;
    • setMinAuthorVersion passes the quorum.
• try-runtime --checks all on that network's snapshot: migrations pass and every pallet's try_state passes.
• MetaMask-style user on spec 19 (fresh EVM key, off-chain EIP-712 key derivation):
  • the shield is the only EVM transaction;
  • the transfer and unshield go out unsigned, with no EVM tx and no gas;
  • neither the spend extrinsics nor the pool events contain the user's address or mirror account;
  • no spend carries the deposit's commitment.