Validate ingested data — trust-minimize the backfill source

[tamirms]

TL;DR

Backfill currently requires the data lake to be a trusted source. Validate that the data we ingest is actually correct, so a faulty or malicious source can't silently feed us bad data — removing the trusted-source requirement.

Scope

• Determine how ingested data can be verified as correct without trusting the source, and put that verification in place.

[roebee]

Three questions:

1. Trust anchor: chain ledger hashes back to a trusted genesis, a known-good tip, or both?
2. Scope: backfill only, or live ingest too?
3. Performance: verification must not break the 600 ms close cadence. What overhead budget is acceptable?