Address review findings on the sync-lag duty gate.

Decision logic
- Replace peer-reported head-slot signal with local-store evidence:
  the freshest slot across blocks already validated into the store.
  Drops the unauthenticated peer.status.head.slot path entirely.
- Add NETWORK_STALL_THRESHOLD (= 2 * SYNC_LAG_THRESHOLD) distinct
  from the local threshold so jitter at the local boundary cannot
  also trip the network-wide branch.
- Add HYSTERESIS_BAND so a closed gate reopens only when lag drops
  to threshold - band, preventing slot-over-slot flap.
- Persist gate state on the service; log only on state transitions
  instead of every query.
- Saturate the future-head case at zero lag rather than trusting
  the chain unconditionally.

API and types
- duty parameter typed as Literal["block", "attestation"].
- Split _duties_skipped_lag into _blocks_skipped_lag and
  _attestations_skipped_lag, owned by the run loop. Attribution
  flattened so wrong-interval slots never tick the gate counter.
- Drop redundant int(slot) casts where Slot arithmetic suffices.
- Remove PeerManager.get_network_head_slot and its tests now that
  no caller remains.

Tests
- Replace patch.object(PeerManager, ...) mocks with real
  PeerManager and store manipulation, matching repo policy.
- New helpers preserve the block-map key-equals-root invariant.
- Add hysteresis flap test, split-counter test, transition-only
  log assertion. Use substring checks instead of exact log strings.

Documentation
- Constants, gate method, properties, fields, and inline comments
  rewritten per /doc rules: structured Why/Effect/Decision matrix
  labels, one idea per line, no function or variable names in
  prose, concrete numbers throughout.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>