fix(iota-core): select the fullnode submission driver per request from the current epoch store (#12520)

[filipdulic]

Description of change

The fullnode's TransactionOrchestrator picked its submission driver (QuorumDriver vs TransactionDriver) once, at process start; validators check enable_pcool_flow per request. A fullnode not restarted after the flip epoch kept submitting on the rejected path.

Enabling P-COOL is seamless. Disabling it again is not planned for mainnet/testnet, so a node that booted under P-COOL requires a restart to serve the certificate flow (team decision).

• The epoch's P-COOL flag selects the flow serving a request, mirroring the validator-side checks.
• The TransactionDriver always exists, with its reconfig observer running from boot, so it tracks epochs before the flag enables it. Its latency-ping and health-check rounds are skipped while the flow is disabled (pings go through the real submission path, which validators reject) and resume when the flag returns; both tasks hold weak references and exit on teardown.
• The QuorumDriver is built only on a flag-off boot (Option), together with its effects/pending-log cleanup loop and WAL recovery. On a node that booted under P-COOL, submissions selecting it fail with an internal error whose detail says a restart is required (also logged by the fullnode), and the effects subscription is unavailable.
• Driver accessors are test-only; production code reaches a driver only through per-request selection.
• Driver metrics register up front regardless of boot mode.
• TransactionDriver::new takes Option<ValidatorClientMonitorConfig> instead of Option<&NodeConfig>, plus a P-COOL predicate.
• New test util AuthorityState::reconfigure_for_testing_with_protocol_config lets tests change the protocol config at an epoch boundary.

A stale-committee first attempt right after the flip epoch is covered by the existing retry machinery: epoch mismatches are retriable and the TransactionDriver reloads its aggregator on every attempt, the same as any epoch boundary.

Links to any relevant issues

fixes #12520

How the change has been tested

• Basic tests (linting, compilation, formatting, unit/integration tests)
• Patch-specific tests (correctness, functionality coverage)
• I have added tests that prove my fix is effective or that my feature works
• I have checked that new and existing unit tests pass locally with my changes

New tests:

• e2e: OFF→ON flip via a real v31→v32 protocol upgrade; the same fullnode submits on both sides of the boundary.
• Unit: a flag-off boot builds the quorum driver and runs WAL recovery at construction; a node booted under P-COOL rejects quorum-driver selection after a rollback and returns no effects receiver.

Unit tests and clippy verified locally; simtests run in CI.

Release Notes

• Protocol:
• Nodes (Validators and Full nodes): Full nodes now follow the P-COOL enablement at the epoch boundary without a restart, and stop sending latency pings and health checks while the P-COOL flow is disabled. Full nodes that started while P-COOL was enabled require a restart before serving the certificate flow after a rollback; until then their submissions fail and the fullnode log states that a restart is required.
• Indexer:
• JSON-RPC:
• GraphQL:
• CLI:
• Rust SDK:
• gRPC:

[bingyanglin]

LGTM. Only a small lint.