fix(node): scope startup rewind to a non-fresh DB and require VALID (PR review pass 68)

Codex review pass 68 raised two P1s on the pass-66/67 startup head-reconciliation.

P1a — do not apply the head-repair to a fresh rollup database. The pass-66
reconciliation fired whenever the execution node's head sat above the persisted
L2 head, including when the persisted head is 0. A fresh rollup database against
an already-synced execution datadir is a legitimate bootstrap (permitted by
startup_refusal), and the zero anchor is not authoritative there: the repair
would construct head=safe=0 and either fail startup with SafeBelowFinalized (when
the execution node's finalized marker is above 0) or, via the pass-67 push,
rewind the execution node's canonical head all the way back to genesis. Gate the
reconciliation on a non-zero persisted head, so bootstrap adopts the provider
forkchoice unchanged — exactly as the pre-existing repair loop already does (its
`> finalized` bound is likewise never met at 0).

P1b — treat a non-VALID startup rewind as a launch failure. The pass-67 push
logged a warning and launched on SYNCING/ACCEPTED, on the assumption a later FCU
would reassert the head. But the orchestrator starts L2-Synced with no
l2_sync_recheck_target, and the periodic recheck only fires while L2 is syncing
with a target, so on a quiescent node nothing reissues the FCU and the execution
node keeps serving the discarded head. The rewind target is an ancestor the
execution node already holds, so VALID is the only correct answer; any other
status now fails startup so the supervisor restarts and retries, rather than
launching on a head the execution node has not adopted.

Both fixes are in the startup path already tracked for e2e coverage in
.claude/vmark-pr-review-follow-ups.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: vmarkushin

crates/node/src/args.rs

@@ -679,7 +679,15 @@ impl ScrollRollupNodeConfig {
         // node never signed or announced — forking it from its peers. Drag the
         // engine head back down to the persisted head; the persisted head is at
         // or below finalized here, so it is guaranteed present in the EN.
-        if fcs.head_block_info().number > l2_head_block_number {
+        //
+        // Excluded when the persisted head is 0: a fresh rollup database against
+        // an already-synced execution datadir is a legitimate bootstrap that
+        // `startup_refusal` permits, and the zero anchor is NOT authoritative
+        // there — treating it as such would rewind the execution node to genesis
+        // (or fail with SafeBelowFinalized when its finalized marker is above 0).
+        // Bootstrap adopts the provider forkchoice unchanged, exactly as the
+        // loop above (whose `> finalized` bound is likewise never met at 0) does.
+        if l2_head_block_number > 0 && fcs.head_block_info().number > l2_head_block_number {
             if let Some(block) = l2_provider
                 .get_block(l2_head_block_number.into())
                 .full()
@@ -764,15 +772,21 @@ impl ScrollRollupNodeConfig {
                         result.payload_status.status
                     );
                 }
-                Ok(_result) => {
-                    // SYNCING/ACCEPTED: the execution node took the head but has
-                    // not finished adopting it. The mirror already holds it and
-                    // every later FCU reasserts it, so do not fail startup.
-                    tracing::warn!(
-                        target: "scroll::node::args",
-                        ?head,
-                        "Execution node has not yet adopted the recovered startup head; it will \
-                         be reasserted"
+                Ok(result) => {
+                    // Non-VALID (SYNCING/ACCEPTED): the execution node has NOT
+                    // adopted the rewind. The rewind target is an ANCESTOR the
+                    // execution node already holds, so VALID is the only correct
+                    // answer — anything else means it is in an unexpected state
+                    // (e.g. still snap-syncing). We cannot launch anyway: the
+                    // orchestrator starts L2-Synced with no recheck latch, and
+                    // its periodic recheck only fires while L2 is syncing WITH a
+                    // target, so nothing would reissue this FCU on a quiescent
+                    // node — it would keep serving the discarded head. Fail
+                    // startup so the supervisor restarts and retries.
+                    eyre::bail!(
+                        "execution node did not adopt the recovered startup head {head:?} \
+                         (status {:?}); refusing to launch on the discarded head",
+                        result.payload_status.status
                     );
                 }
                 Err(err) => {