[Follow-up] Add finalization-time withdrawal inclusion and duplicate-finalization monitoring

> **Priority:** best effort. Tracked in the withdrawals-mon follow-ups: ethereum-optimism/protocol-team#208.

## Context

Follow-up from PR #176:

https://github.com/ethereum-optimism/monitorism/pull/176#discussion_r3616815292

The existing `faultproof-withdrawals` monitor checks `sentMessages[withdrawalHash]` while processing `WithdrawalProvenExtension1`. It does not monitor `WithdrawalFinalized` events or detect the same withdrawal being finalized more than once.

PR #176 should therefore be treated as supplemental proof-integrity monitoring rather than a complete replacement for all existing withdrawal-monitor coverage.

## Goal

Add companion monitoring for withdrawal finalization safety.

## Required coverage

1. Watch `WithdrawalFinalized` events.
2. At finalization time, verify that `sentMessages[withdrawalHash]` exists in canonical safe L2 state.
3. Detect and alert when the same withdrawal hash is finalized more than once.
4. Preserve sufficient state or history to detect duplicates across monitor restarts.

## Acceptance criteria

- Every `WithdrawalFinalized` event receives an inclusion verdict against canonical safe L2 state.
- Missing inclusion produces a high-severity alert with useful transaction and withdrawal context.
- Duplicate finalizations are detected, including duplicates separated by a restart.
- RPC failures cannot silently discard a finalization check.
- Tests cover:
- valid finalization;
- finalization without canonical-safe-L2 inclusion;
- duplicate finalization;
- restart between duplicate events.
- Documentation distinguishes:
- proof-time inclusion monitoring;
- proof-integrity monitoring;
- finalization-time inclusion monitoring;
- duplicate-finalization detection.

This companion coverage is required before sunsetting the existing withdrawal monitor.