docs(design): specify VCT root authentication

[p0mvn]

Motivation

Header sync receives peer-supplied commitment roots and ZIP-221 leaf inputs that must be authenticated before they become authoritative VCT state. The design needs explicit ownership, persistence, recovery, scheduling, and peer-attribution invariants before implementation proceeds.

Solution

• define state-owned root-authentication and completed-checkpoint frontiers
• require atomic promotion through a verified-root persistence boundary
• specify migration and recovery for existing mixed-provenance root rows
• establish forward-only startup and exact asynchronous operation identity
• document failure handling, implementation phases, metrics, and test coverage

Testing

• markdownlint docs/design/header-sync-vct-root-authentication.md --config .trunk/configs/.markdownlint.yaml
• IDE diagnostics report no errors for the document

This is a low-risk documentation-only change, so Rust builds, Clippy, and tests were not run under the repository's risk-based verification policy.

Specifications & References

• Builds on the verified-prefix and overlap work from feat(network): verify Zakura header-sync commitment roots before persisting #62 while assigning canonical frontier ownership to state.

Follow-up Work

• Implement the authentication phases in focused PRs.

[v12-auditor]

Warning

No auditable source files found in this PR's diff.