kona pure derivation — Phase 3: build pure::Deriver + full span-batch overlap check

Build the pure (sync, IO-free) deriver on top of `core/*`. Add the missing post-Holocene full span-batch overlap content check (closes the spec gap referenced in #20695).

## API

```rust
fn derive(&mut self, safe_head: L2BlockInfo) -> (Derivation, DeriveTrace) // never returns Err
fn add_l1_input(&mut self, L1Input) -> Result<(), CriticalError> // Err only on contract violations
fn add_span_batch_overlap(&mut self, SpanBatchOverlap) -> Result<(), CriticalError>
fn reset(&mut self, safe_head: L2BlockInfo, sys_config: SystemConfig)
```

`Derivation::{Attributes, NeedL1Input, NeedSpanBatchOverlap{parent, content}}`. Correct derivation always makes progress; malformed frames/channels/batches/logs are silently dropped and emit `TraceEntry` entries. Strictly-typed reason enums, no string fields.

## Deliverables

- `crates/protocol/derive/src/pure/`: `deriver.rs`, `types.rs`, `extract.rs`, `overlap.rs`.
- `extract_l1_input(header, txs, receipts, rollup_cfg) -> L1Input` helper — filter-only (no parsing, no `SystemConfig` parameter). The deriver internally parses raw `deposit_logs` / `config_logs` and emits trace events on failure.
- Full byte-wise span-batch overlap content check using raw tx bytes from `SpanBatchOverlapBlock.txs` — no `encode_2718` round-trip.
- Reset semantics pinned: clears pending channels, decoded-but-un-emitted batches, active span-batch state, L1 input buffer; supplied `sys_config` becomes the new rolling sysconfig.
- No `tracing::*` calls inside `pure/`.
- `pure/` is `no_std` — verified on riscv target.
- Replay test (`crates/protocol/derive/tests/replay.rs`): byte-equal `OpAttributesWithParent` parity vs. the existing `DerivationPipeline` across a recorded mainnet L1 range covering ≥1 syscfg update, ≥1 overlapping span batch, and ≥1 hardfork activation boundary. **Phase 4 cannot proceed until the activation case passes.**
- Per-component unit tests assert specific `TraceEntry` shapes — no log-grep assertions.

Builds on Phase 2.
Part of #20695.

🤖 *Generated by Claude Code*