fix(xmss): prevent FFI keypair leaks on partial load and unclean shutdown

[dimka90]

Summary

• Clean up previously loaded XMSS keypairs when loadValidatorKeys() fails mid-loop, preventing Rust memory leaks on partial load (zeam errdefer keypair.deinit() pattern,
  cli/src/node.zig:433)
• Add defer n.Close() in main.go so keypairs are freed on all exit paths including os.Exit and panic
• Free XMSS keypairs in Node.Close() before closing DB and P2P services
• Add runtime.KeepAlive guards after all CGo calls that pass Go pointers to Rust:
  • leansig.go: RestoreKeypair, Sign, Verify, VerifyWithKeypair
  • leanmultisig.go: Aggregate, VerifyAggregated

Context

Rust-allocated XMSS keypairs (loaded via CGo FFI) were leaked in two scenarios:

1. If loading validator 3 out of 5 failed, keypairs 0-2 were never freed — the error return path didn't clean up partial state
2. If the process exited via os.Exit(1) (error path in main.go) or panic, Close() was never called and keypairs were never returned to Rust

The runtime.KeepAlive guards are a defensive hardening — without them, the Go GC could theoretically collect slices passed to C while the Rust FFI call is still executing. Unlikely
in practice since CGo pins the goroutine, but it's the accepted best practice per CGo documentation.

Test plan

• go build ./... compiles cleanly
• go vet ./... passes
• go test ./node/... -count=1 — node tests pass
• go test ./xmss/leanmultisig/... -count=1 — multisig tests pass
• go test -race ./node/... ./xmss/leanmultisig/... — no races
• Local 3-node devnet — nodes start, sign attestations, and shut down cleanly
• Kill node with SIGINT — verify no Rust memory warnings in logs
• Intentionally break a validator key file — verify node exits cleanly without leaking other loaded keys
  Closes FFI keypairs leaked on partial load failure and missing runtime.KeepAlive guards #191