Verify downloaded beacon states by root

[samcm]

Summary

This PR tightens full-mode beacon-state bundle ingestion. Downloaded states are now requested by the expected state root and verified locally before they are cached.

Changes

• Fetch checkpoint states from upstreams by the expected state root instead of by slot.
• Recompute the downloaded beacon state root and reject mismatches before cache insertion.
• Add regression tests for root-based state fetches and mismatched-state rejection.

Other notes

• No API or config changes.