kona-node-service: ChainController Invalidate handler

Apply order: freeze spokes + pause unsafe application + drain buffered payloads (optimism-private#577) → park/reset derivation → build the deposits-only replacement from command data as ConsolidateInput::Attributes (engine auto-reorgs; insert advances local-safe only) → confirm heads → SafeDB truncate → resume → ack ("replacement is canonical"). Derivation parks before the build so the post-build head push never hits an invalid state-machine transition. Post-apply, stale branches are refused by the descent check — no durable filter. An Invalidate at height H supersedes any in-flight Holocene EL-INVALID deposits-only fallback at H.

Depends on: #22540, #22526 (targeted reset), #22527, #22539.

🤖 *Co-created with Claude (Fable 5)*

Start at the kona-node-service ChainController Invalidate handler and read dependencies #22540, #22526, #22527, and #22539 to understand the targeted reset and fallback behavior. Trace the apply sequence from freezing spokes through canonical acknowledgment, ensuring derivation is parked before the replacement build and stale branches are rejected; done means the specified Invalidate path handles the heads, SafeDB, resume, and ack correctly.

Written by the indexing model from the issue text.