Follow-up (#3293): stamp expiry on genesis mock sentinels and drop node mock-identity fallback

[barakeinav1]

Background

Follow-up to #3293 / #3785. Two loose ends remain after making mock attestations cleanable:

1. The genesis sentinel path TeeState::with_mocked_participant_attestations (used by init / init_running, crates/contract/src/tee/tee_state.rs) still stores non-expiring MockAttestation::Valid. fix(contract): make mock attestations cleanable via expiry #3785 stamps an expiry on submitted mocks and migrates existing stored entries, but a fresh init can still create a mock that never expires and can never be cleaned up. Stamping these too changes the Figure out a good way to initialize the contract with attestations enforced for hard launch #1087 placeholder semantics (a participant that never submits a real attestation would auto-expire), which is why it was deferred.
2. Because a no-expiry mock can still exist, the node keeps a backward-compat fallback in submitted_attestation_landed (crates/node/src/indexer/tx_sender.rs): a mock with no stored expiry is matched by identity instead of the expiry-changed heuristic. Once every stored mock carries an expiry, that None arm is dead code and the mock case collapses into the same heuristic Dstack uses.

Acceptance Criteria

• with_mocked_participant_attestations stamps an expiry on the mock sentinels it creates (decide on the Figure out a good way to initialize the contract with attestations enforced for hard launch #1087 auto-expiry behavior first).
• The node's submitted_attestation_landed mock-identity fallback (None arm) is removed once all stored mocks are guaranteed to carry an expiry.

Resources & Additional Notes

• Depends on fix(contract): make mock attestations cleanable via expiry #3785 being deployed (contract upgraded + migration run).
• Related: Figure out a good way to initialize the contract with attestations enforced for hard launch #1087 (thread real attestations through initialization so the sentinel can go away), and the TODO(#1639) expiry heuristic which would eventually replace this landing check entirely.

[barakeinav1]

Checked the #3785 deployment precondition while working on #3951.

#3785 is deployed on both networks: version() returns 3.14.0 on v1.signer and 3.14.1 on v1.signer-prod.testnet. The stamping commit (b4bea09) is contained in 3.14.0, so both carry it.

No stored entry lacks an expiry today. Swept every get_tee_accounts entry, not just participants — 15 on mainnet (9 Mock::WithConstraints, 6 Dstack), 20 on testnet (18 Dstack, 2 Mock::WithConstraints, including 3 stale non-participant rows). All 35 carry an expiry, so the #3785 migration plus subsequent re-stamping has cleared the legacy rows.

But AC 1 still gates AC 2. with_mocked_participant_attestations (crates/contract/src/tee/tee_state.rs:108) still inserts a bare MockAttestation::Valid straight into stored_attestations, bypassing with_expiry_capped_at. So a fresh init / init_running recreates the no-expiry condition, and the node's None arm cannot be dropped on the strength of current live state alone.