fix(WeightedECDSASigner): prevent weight double-counting (lightweight)

[leekt]

Summary

Fixes TOB-KERNEL-17 (High): Weights can be double-counted in WeightedECDSASigner.

• In _checkUserOp: after recovering the last signer from userOpHash, adds if (signer <= lastSigner) return SIG_VALIDATION_FAILED_UINT
• Enforces that the userOpHash signer address is strictly greater than the last proposalHash signer
• Prevents a single guardian from reaching threshold alone by submitting duplicate signatures

Note: This is a lighter alternative to the approach in fix/tob-kernel-15 (PR #43). It only fixes the double-counting issue and does NOT include zero-weight/gas-griefing fixes (TOB-KERNEL-15) or early-return removal (TOB-KERNEL-16). Superseded by PR #43 which includes the more comprehensive fix.

Audit Reference

• Finding: TOB-KERNEL-17 — Weights can be double-counted in WeightedECDSASigner
• Severity: High
• Auditor: Trail of Bits (Offchain Labs Kernel v4 Security Assessment, January 2026)

Test plan

• Verify that a guardian cannot double-count their weight by signing both proposalHash and userOpHash
• Verify that distinct guardians with ascending addresses still pass validation
• Verify the lightweight ordering check correctly rejects duplicate signers

[leekt]

Closing: TOB-KERNEL-17 is already fixed in fix/tob-kernel-16 (PR #41), which is merged into fix/tob-kernel-15 (PR #43). This lightweight alternative is superseded.