feat: bind validator PoP to chainId and registrantAddress

[shahin-hq]

Summary

Closes: https://app.clickup.com/t/2570579/86e3gp5da

• Validator proofs are now tied to an account and a network. A proof created for one sender or one chain can't be reused by anyone else.
• New method name: validator registration and update now use validator_proof(passphrase, registrant_address) in place of validator_passphrase(passphrase). The encoder helpers also take the address.
• Typos in the address are caught: a malformed address or one with a bad checksum is rejected with a clear error.
• Tests: new tests check the proofs against Mainsail's reference data, and the existing fixtures were updated.
• Fixed CI: a dependency (btclib) released a version that broke installs, so it's now pinned to a version that works.

Checklist

• Documentation (if necessary)
• Tests (if necessary)
• Ready to be merged

[shahin-hq]

btclib was unpinned, so CI installed whatever was newest. Releases from 2026.9.29 onward no longer ship btclib.mnemonic, which crypto/identity/bls_private_key.py imports (from btclib.mnemonic import bip39). As a result, every BLS-related test failed at import on fresh installs.

2023.7.12 is the newest release that still supports Python 3.9 (all 2026.x releases require ≥3.10). Our CI matrix covers 3.9–3.12, so this is the only version that installs on all of them. On 3.9, pip was already resolving to it anyway.