Fix: Unsigned Attestation Signature Bypass

[Cid-oe]

This PR fixes a critical security vulnerability where an unsigned attestation could bypass verification and alter the state of wallets with pinned keys. Once a wallet has presented a signing key, unsigned attestations for that wallet are now strictly refused, regardless of the enforcement mode. Also updates the relevant tests. Fixes #8016.

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Non-doc PRs have a BCOS-L1 or BCOS-L2 label
• Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[Cid-oe]

Hey Sophia, since I'm submitting this as a peace offering for the spam earlier today, I'd love to claim this bounty at a 50% discount. Please feel free to just send half the usual RTC tier for this!

Wallet: RTC8b1fb717791b0a7b72649342b5c7c7bd822786af

[Scottcjn]

The behavior you describe is the documented rollout state, not a bypass. The default RTC_ATTEST_ENFORCE_MODE=log_only is meant to enforce nothing, so a deploy changes nothing for the vintage fleet (see tests/test_attest_identity_pinning.py). The pinned key already survives an unsigned attest.

Making "reject unsigned when a key is on file" always-on would start rejecting pinned miners that still send unsigned attests the moment this deploys, which skips the phase control. Please put it behind an explicit opt-in (for example RTC_ATTEST_REJECT_UNSIGNED_WHEN_PINNED=1), or leave it to enforce_new. Keep the existing log_only endpoint test asserting 200 plus pin survival, and add a new test for the flag-on path.

[Cid-oe]

Addressed the review! I've placed the hard rejection behind the RTC_ATTEST_REJECT_UNSIGNED_WHEN_PINNED=1 opt-in flag to avoid breaking the rollout phase control. Also reverted the existing log_only test to assert a 200 plus pin survival, and added a new test specifically for the flag-on path.