Align fetched snapshot verification with local joins

[cjen1-msft]

Joiners accept local snapshots signed by a previous service identity, but reject fetched copies because the fetch path checks the signer against the current service certificate.

This PR removes that extra check. Fetched snapshots use the same receipt checks as local join snapshots, both during recovery and after the service opens.

The production change is one line:

-verify_snapshot(segments, join_config.service_cert);
+verify_snapshot(segments);

Digest and Merkle proof checks remain. Snapshot contents are authenticated by GCM with ledger keys during full deserialisation, immediately for an open service or during private recovery. The configured service certificate still authenticates the connection to the service.

Before

flowchart TD
    F["Fetch snapshot"] --> D["Check digest and Merkle proof"]
    D --> S{"Signed by current service identity?"}
    S -->|Yes| J["Receive authenticated join response"]
    S -->|No| R["Reject fetched snapshot"]
    J --> I["Continue through existing join path"]
    I --> G["Authenticate contents with GCM during full deserialisation"]

Loading

After

flowchart TD
    F["Fetch snapshot"] --> D["Check digest and Merkle proof"]
    D --> J["Receive authenticated join response"]
    J --> I["Continue through existing join path"]
    I --> G["Authenticate contents with GCM during full deserialisation"]

Loading

Existing recovery trust assumption

This PR adopts the existing local-snapshot trust model. During recovery, joiners use public snapshot state before GCM authentication. The safety of those early effects, including network.secrets hooks, is a separate concern shared with the local path. This PR does not establish that safety or change those hooks.

Validation

• logging builds.
• recovery_snapshot_endorsements_test passes. The join scenario checks that local and fetched previous-identity snapshots are used during recovery and after opening, rather than falling back to ledger replay.
• scripts/ci-checks.sh passes.
• The earlier Sphinx build was blocked by Doxygen 1.17.0 rejecting the existing ccf::pal::ccf::ds::Mutex alias. It has not been rerun for this revision.