fix(bft): proposer rebroadcasts proposal up to 3× at 3s intervals (#1d)

[satyakwok]

Summary

Closes the real root cause of the 2026-04-20 testnet livelock. PR
#174's 10→20s propose_timeout bump alone didn't help — tally logs
kept firing every ~25 seconds.

Cross-validator trace at a stuck height:

T+0.0s  proposer broadcasts Proposal
T+0.0s  2 peers in verified_peers receive it → prevote block
T+12s   prevote_timeout fires on those 2 → nil-precommit
        (needed 3-of-4 supermajority; only 2 votes for block)
T+21s   third peer finally hits propose_timeout, nil-prevotes
        too late — other 2 already in precommit phase
→ round skipped, repeat forever

Longer propose_timeout widened the gap between fast and slow peers
instead of closing it. Proper fix: proposer retries the broadcast
every 3s up to 3 times while still in Propose phase, so peers that
just reconnected (and weren't in verified_peers at initial send)
still receive the proposal before their own propose-phase expires.

3s × 3 retries = up to 9s of retry window inside the 20s propose
phase. Plenty of headroom for reconnect stragglers, without spamming
the network.

Implementation

• validator loop tracks proposal_broadcast_at + proposal_rebroadcast_count
• tick loop checks: if we are proposer AND phase == Propose AND we
  have a proposed_block AND last broadcast ≥ 3s ago AND count < 3
  → re-sign + re-broadcast, bump count.
• reset both on new height; reset both at each late-round propose
  site (skip/timeout re-proposals).
• emits BFT #1d: rebroadcast proposal... per retry so the fix is
  observable in journalctl.

Test plan

• cargo clippy --workspace --tests -- -D warnings clean
• cargo test --workspace — all 38 suites pass
• CI green
• Deploy to testnet; bake for 1 hour; check fire rate of
  BFT #1d: logs (should drop sharply) and look for
  BFT #1d: rebroadcast proposal lines (proves retry is
  actually firing).

Related

• Diagnosis: debug(bft): log block_hash + nil-skip tally for #1d investigation #171 added the tally logging that exposed the shape.
• Partial-fix attempt: fix(bft): bump propose timeout 10→20s to close #1d livelock window #174 bumped the timeout; this PR completes
  what that one couldn't.
• Follow-up (not in this PR): peer-subscribe on newly-verified
  peers so the proposer rebroadcasts the moment a peer joins
  mid-round, instead of waiting for the retry timer.