Add Colibri verified RPC provider (env-gated)

[simon-jentzsch]

• Adds optional Colibri-stateless integration as a verified RPC path for Sepolia (11155111) behind USE_COLIBRI=true.
• Introduces ColibriRpcProvider (extends ethers.JsonRpcProvider) and routes send(method, params) through Colibri’s EIP‑1193 request().
• Keeps JsonRpcProvider compatibility (destroy(), _getConnection().url, etc.) to avoid broader refactors.
• eth_call with state override (3rd param object) is bypassed and executed via the underlying RPC provider to preserve deployless/state-override behavior.
• Default prover: https://sepolia.colibri-proof.tech/ (override via COLIBRI_PROVER_URLS).
• Colibri docs: JS/TS bindings

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​corpus-core/​colibri-stateless@​1.1.1
	js-yaml@​4.1.1 ⏵ 4.1.0		-1

View full report

[superKalo]

Thanks for your PR. We will discuss further internally the option for having this and will get back to you.

Just so you know, we currently are having ongoing efforts to refactor the RPC provider usage across the whole app to always use the Provider controller instance from the background. Ideally, completing this would be a prerequisite before having your changes. Otherwise - different parts of the code (including the extension front-end) still create or use their own provider references when making RPC requests and I'm not sure the changes you did would fit in consistently.

Let's touch-base again in the next days.