feat: add stateless path to publishExecutionPayloadEnvelope (gd5)

[ensi321]

Summary

Port of #9401 (stateless publishExecutionPayloadEnvelope) onto glamsterdam-devnet-5 instead of unstable. Same 7 commits, cherry-picked clean.

• Accepts both SignedExecutionPayloadEnvelopeContents (envelope + blobs + KZG proofs, stateless) and bare SignedExecutionPayloadEnvelope (stateful), discriminated by JSON key / first SSZ offset.
• KZG-verifies supplied blobs and proofs against bid kzg_commitments; rejects partial wrapper inputs.
• Endpoint paths already pluralized on gd5 base per beacon-APIs Update to v0.9.3 spec #613 (execution_payload_envelopes, execution_payload_bids).

Spec alignment (beacon-APIs #580)

Path, request shape, headers, query, and body codec match #580's envelope_post.yaml. Known gaps left as-is (pre-existing TODOs referencing #580):

• broadcast_validation not yet honored (always gossip-level).
• No 202 response branch (success always 200).

Test plan

• pnpm check-types
• pnpm test:unit (api + beacon-node envelope publish tests)
• Devnet smoke test of envelope publish (stateless + stateful)

AI disclosure

Branch creation, cherry-pick, and this PR description were AI-assisted (Claude Code).

[gemini-code-assist]

Code Review

This pull request updates the publishExecutionPayloadEnvelope endpoint to support optional blobs, kzgProofs, and broadcastValidation parameters, implementing JSON and SSZ serialization/deserialization (with SSZ offset discrimination) and backend validation of blobs/proofs to construct data column sidecars. The review feedback highlights a critical issue where duplicate publishes for the same block can trigger an unhandled error in payloadInput.addPayloadEnvelope, resulting in a 500 Internal Server Error. It is recommended to check payloadInput.hasPayloadEnvelope() and return early to handle duplicate publishes gracefully.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If publishExecutionPayloadEnvelope is called multiple times for the same block (which is common in redundant/fallback setups or due to client retries), calling payloadInput.addPayloadEnvelope will throw an unhandled Error: Payload envelope already set for block ... and result in a 500 Internal Server Error.

To prevent this, we should check if the payload envelope is already set using payloadInput.hasPayloadEnvelope() and return early (benign duplicate publish).

Suggested change

	const payloadInput = chain.seenPayloadEnvelopeInputCache.get(blockRootHex);
	if (!payloadInput) {
	throw new ApiError(404, `PayloadEnvelopeInput not found for block root ${blockRootHex}`);
	}
	const payloadInput = chain.seenPayloadEnvelopeInputCache.get(blockRootHex);
	if (!payloadInput) {
	throw new ApiError(404, "PayloadEnvelopeInput not found for block root " + blockRootHex);
	}
	if (payloadInput.hasPayloadEnvelope()) {
	chain.logger.debug("Execution payload envelope already set, ignoring duplicate publish", {
	slot,
	blockRoot: blockRootHex,
	});
	return;
	}