ci: generate test fixtures from pinned leanSpec commit (#118)

Closes #115

## Summary

- Instead of downloading the latest `fixtures-prod-scheme` artifact from
leanSpec's CI (which could drift from our pinned version), we now
checkout leanSpec at the exact `LEAN_SPEC_COMMIT_HASH` from the Makefile
and generate fixtures in CI.
- The commit hash is extracted from the Makefile at runtime, keeping a
single source of truth.
- Two-layer caching strategy:
- **Fixture cache** (keyed on commit hash): skips all Python/uv steps
when the pinned version hasn't changed.
- **Production keys cache** (keyed on key URL hash): avoids
re-downloading keys when only the leanSpec commit changes.

This is similar to how leanSpec builds the fixtures in their CI:
https://github.com/leanEthereum/leanSpec/blob/2997030704db02d15ea4318bd05682586c887c0a/.github/workflows/prod-vectors.yml

Author: MegaRedHand

.github/workflows/ci.yml

@@ -47,13 +47,71 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      # NOTE: we download the latest fixtures since generating them in CI fails
-      - name: Download test fixtures
-        env:
-          GH_TOKEN: ${{ github.token }}
+      # Read the pinned leanSpec commit from the Makefile (single source of truth)
+      - name: Get leanSpec pinned commit
+        id: lean-spec
+        run: echo "commit=$(sed -n 's/^LEAN_SPEC_COMMIT_HASH:= *//p' Makefile)" >> $GITHUB_OUTPUT
+
+      - name: Cache test fixtures
+        id: cache-fixtures
+        uses: actions/cache@v4
+        with:
+          path: leanSpec/fixtures
+          key: leanspec-fixtures-${{ steps.lean-spec.outputs.commit }}
+
+      # All fixture generation steps are skipped when the cache hits
+      - name: Checkout leanSpec at pinned commit
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        uses: actions/checkout@v6
+        with:
+          repository: leanEthereum/leanSpec
+          ref: ${{ steps.lean-spec.outputs.commit }}
+          path: leanSpec
+
+      - name: Install uv and Python 3.14
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "leanSpec/pyproject.toml"
+          python-version: "3.14"
+
+      - name: Sync leanSpec dependencies
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        working-directory: leanSpec
+        run: uv sync --no-progress
+
+      - name: Get production keys URL hash
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        id: prod-keys-url
+        working-directory: leanSpec
         run: |
-          mkdir -p leanSpec/fixtures
-          gh run download --repo leanEthereum/leanSpec --name fixtures-prod-scheme --dir leanSpec/fixtures
+          URL=$(uv run python -c "from consensus_testing.keys import KEY_DOWNLOAD_URLS; print(KEY_DOWNLOAD_URLS['prod'])")
+          HASH=$(echo -n "$URL" | sha256sum | awk '{print $1}')
+          echo "hash=$HASH" >> $GITHUB_OUTPUT
+
+      - name: Cache production keys
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        id: cache-prod-keys
+        uses: actions/cache@v4
+        with:
+          path: leanSpec/packages/testing/src/consensus_testing/test_keys/prod_scheme
+          key: prod-keys-${{ steps.prod-keys-url.outputs.hash }}
+
+      - name: Download production keys
+        if: steps.cache-fixtures.outputs.cache-hit != 'true' && steps.cache-prod-keys.outputs.cache-hit != 'true'
+        working-directory: leanSpec
+        run: uv run python -m consensus_testing.keys --download --scheme prod
+
+      - name: Generate test fixtures
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        working-directory: leanSpec
+        run: uv run fill --fork=Devnet --scheme prod -o fixtures -n 2
+
+      # Ensure make sees fixtures as up-to-date (its timestamp must be
+      # newer than leanSpec/, which intermediate steps may have modified).
+      - name: Mark fixtures as up-to-date
+        run: touch leanSpec/fixtures
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master