Mirror leanSpec #1181: an equivocator can cast two distinct votes at one
slot. ExtractLatestAttestations now keeps, per validator, the vote with the
highest (slot, attestation-data hash-tree-root), so the extracted LMD view is
a pure function of the pool, independent of insertion order, and every node
runs fork choice on the same set. Block production already applied the same
canonical-root secondary sort key.

Mirror leanSpec #1182: reject a block whose slot exceeds the store clock by
more than one slot (BLOCK_TOO_FAR_IN_FUTURE), in on_block before the transition
and signature check, so a far-future block cannot force an unbounded empty-slot
walk. currentSlot = store.Time()/IntervalsPerSlot; the full-slot margin still
admits an intended early block. The signatures spectest now sets the store clock
to the block's slot, as the live node does before importing an on-time block.

Mirror leanSpec #1179: attestation admission now rejects a vote whose head does
not descend from the finalized block (HEAD_NOT_DESCENDANT_OF_FINALIZED),
mirroring the prune predicate so a re-gossiped below-finalized aggregate cannot
re-enter the pool after pruning dropped it.

… errors

Mirror leanSpec #1178: reject a zero-validator registry (EMPTY_VALIDATOR_REGISTRY)
instead of silently no-oping, and reject a justification vote bitlist whose length
is not len(justifications_roots) * validator_count
(JUSTIFICATION_VOTES_LENGTH_MISMATCH) rather than reading past or short of a
segment. The existing zero-root check is retained, in spec order.

At pin 4ca7d27 the justifiability fixtures carry delta = slot - finalizedSlot as
a signed value (negative for slots before the finalized boundary). Type the
fixture field int64 and compute the cross-check delta with signed subtraction;
gean's SlotIsJustifiableAfter already returns false for slot < finalizedSlot, so
this is a fixture-parser catch-up only.

The #1179-reworked store-pruning fixture expects a vote gossiped as "new" to be
"known" after the next block step. The harness promoted the payload pool
(PromoteNewToKnown) but left the fork-choice known tracker unchanged, so the
just-promoted vote was absent from the tracker the attestationChecks read.
Re-derive the known votes from the promoted pool, mirroring the Engine's next
updateHead.