fix: tighten downtime anchoring, challenge lookup, and the challenge CLI

[giunatale]

Precision fixes across the downtime and equivocation pipeline, plus two real
defects in the downtime-challenge CLI that made the default invocation unable
to ever verify.

Keeper fixes

• Window-end anchoring: windowEndTimestamp resolved a window's timestamp
  against the consumer client's consensus states; with sparse or pruned states
  an unbracketed anchor could skew the window's age and mis-price a slash. An
  evidence packet whose window end cannot be bracketed by stored consensus
  states is now rejected rather than guessed at (parameter-free, fail-closed).
• Challenge lookup robustness: the pending-slash lookup for a challenge
  keyed off the current key-assignment mapping, which key rotation or pruning
  can invalidate while a slash is pending. The accused validator's consumer
  consensus address is now persisted on the pending slash itself and used as a
  fallback, so a challenge always finds its target.
• Double-vote evidence age: deliberately unbounded, now documented and
  tested rather than implicit — equivocation is punished whenever proven (the
  consumer's minimum evidence height is the only gate), and tombstoning makes
  double-punishment impossible.

Infraction parameters become governable

Every slash fraction, jail duration, tombstone flag, SLA window, challenge
window, and evidence max-age was frozen at genesis: SetInfractionParams had no
caller outside InitGenesis, MsgUpdateParams carries only the other parameter
set, and no other message existed. Governance could not respond to an incident,
or to a threshold that turned out to slash honest operators, without a
coordinated binary upgrade — and an unfortunate genesis (zero slash fraction,
tombstone false, zero jail duration all validate) was permanently unfixable.
Two pieces of machinery showed a runtime path had been intended and was
unreachable: SetInfractionParams maintains a record of the superseded downtime
parameters, and the evidence path implements a change-tolerance horizon so
evidence echoing a just-superseded SLA is still judged fairly.

Adds MsgUpdateInfractionParams (authority-gated, mirroring the existing
MsgUpdateParams handler), which makes that machinery reachable and tested:
evidence echoing the superseded SLA is accepted within the horizon and refused
past it. Two cross-parameter hazards are closed at the same time: MsgUpdateParams
could already lower TrustingPeriodFraction out from under the stored infraction
parameters, breaking a pairing genesis validates but no update path re-checked;
and growing the challengeable interval could push it past the trusting period of
clients that are already pinned, silently making queued accusations undefendable —
so growth is now validated against every adopted consumer client, while narrowing
stays unconditional.

Challenge CLI fixes

challenge-consumer-downtime assembles the header/commit/validator material a
validator submits to disprove a downtime accusation. Two defects made it
effectively unusable exactly when needed:

• The default trusted height was the client's latest height — but the light
  client rejects a header at or below its trusted height, and with a live
  relayer the latest height is virtually always past the infraction, so the
  default never verified. It now defaults to the highest stored
  consensus-state height strictly below claimed_height+1, in the header's
  revision, via a paged consensus-state-heights query; a clear error explains
  when no usable state remains. An explicit --trusted-height at or above the
  header height now fails fast client-side.
• The trusted validators were fetched at the trusted height T, but the light
  client checks them against NextValidatorsHash — the set of T+1 — so
  verification only succeeded when the consumer's set happened not to change.
  They are now fetched at T+1 on both the default and override paths.

Testing

Unit: unbracketed-anchor rejection, the consumer-address fallback lookup
(including after key rotation), the unbounded-age property, and the
trusted-height selection helper (revision filtering, bound exclusion,
unsorted input). Build, lint, and the module suite are green; a separate e2e
(in the test-coverage PR) drives this CLI end to end against real chain data.

[giunatale]

Branched from giunatale/feat/offline-detection (#63).
Opened against that branch so only this PR's commit shows; will retarget to main after #63 lands and this rebases.