fix(grovedb): require proofs to descend to the query path

[pauldelucia]

What

GroveDB's layered verifier looks the next layer up by the proof envelope's lower_layers map key, and that key is not hash-bound. A prover who renames or drops the entry for a subtree on the query path gets the same root hash with that subtree's results silently gone — a proof of K = V verifies as a proof that K is absent.

This adds checkEnvelope(proof, expectedPath): the envelope must carry a lower layer for every segment of the query path (once a layer is present its root is hash-bound to the parent), nothing may hang below the path, and prove_options — prover-chosen bytes that steer limit accounting — is pinned to the chain default. verifyGroveDBProof takes expectedPath; verifyItemProof passes its path through; verifyQueryProof takes options.path.

The TS verifier was already refusing the renamed-layer case by accident — the orphaned tree node falls into the leaf branch and its value bytes fail the committed-valueHash binding — so for this SDK the change is a stated property with a precise error, plus the prove_options pin. The fixtures are real grovedb 3.1.0 proofs over the indexed-data layout [subgroves, aave-v3-lending, indexed, Supply].

Testing

• real proofs verify to the root at their path — four real proofs (single key, range, absent key, limited range) verify at their path with the right result counts.
• without the path check … leaf binding — pins that the bare verifier still rejects the renamed layer, and why.
• renamed lower layer is rejected at the query path / dropped lower layer … — both forgeries fail with does not descend.
• a shorter or longer path is rejected — the path must match the envelope exactly.
• non-default prove_options is rejected even without a path.
• verifyItemProof descends when given the path / verifyQueryProof descends when options.path is given — the wrappers wire it.
• Existing suites: the hardening test's synthetic wrapper now emits the default prove_options byte like every real proof; the fixture test accepts the new wrong-path message.

Full suite: 485 passed (481 before), 11 skipped.

Why

A client that treats "not in the results" as "absent" would accept a lie of omission from any API server, with a valid root. Requiring the proof to reach the queried path is what makes an empty result at that path a proven absence.