execution/cache: avoid duplicate work when publishing StateCache batches

## Problem

`SharedDomains.Commit` must copy domain values while collecting a post-commit StateCache batch because flush-callback buffers are temporary. `StateCache.publish` currently copies every value again into a second `preparedStateUpdate` batch. It also computes Keccak-256 for every non-empty code update.

When the persistent code store and StateCache are both enabled, the commit path independently copies the same code and computes the same hash for each consumer. Obsolete publications also pay the preparation cost before the state-version check rejects them.

For large catch-up commits, this adds avoidable allocation, memory bandwidth, and hashing work. This is a performance follow-up to #23005, not a correctness prerequisite for it.

## Proposed direction

- Define an explicit ownership contract for published updates so callback data is copied exactly once and remains immutable while retained by a cache.
- Let the code-store and StateCache paths share that owned code value and its precomputed hash.
- Reject an obsolete publication before preparing its updates.
- Apply accepted updates directly instead of allocating a second batch solely for preparation.

The internal single-update helper should remain defensive if its callers do not provide owned storage.

## Acceptance criteria

- Tests prove that publication retains an owned value without copying it and honors a supplied code hash.
- Existing publication ordering, failed-commit, unwind, and concurrent-read tests remain green under the race detector.
- A representative large-batch benchmark reports before/after publication time and allocations.