fix(staking): harden markValidatorForDeletion (jailed-delete race + non-jailed divide-by-zero)

[vitaly-andr]

markValidatorForDeletion mishandled validator removal in both branches. Same function, same defect class (zeroing state in a way that breaks downstream consumers before the record is gone), so fixed together.

1. Jailed branch — chain halt

The jailed branch called deleteValidatorInternal, removing the validator record and the ValidatorByConsAddr index immediately. CometBFT keeps the validator in LastCommit for ValidatorUpdateDelay blocks (effective 2-block lag — state/execution.go next-next-height plus the NextValidators double-buffer). During that window slashing.BeginBlocker → IsValidatorJailed → GetValidatorByConsAddr fails with ErrNoValidatorFound, halting the chain.

2. Non-jailed branch — divide-by-zero panic

The non-jailed branch zeroed DelegatorShares alongside Tokens. TokensFromShares (validator.go:308) computes shares × Tokens / DelegatorShares, so a MsgUnjail (or any other TokensFromShares caller) landing in the same block as the marking — before DeleteZeroPowerValidators removes the record on the next block — hits a divide-by-zero panic.

Fix

Both paths now zero Tokens but keep DelegatorShares (and, for the jailed path, keep the record + index). Power becomes zero, the existing DeleteZeroPowerValidators defer-path removes the record on a later block — after LastValidatorPower clears and CometBFT has dropped the validator — and TokensFromShares returns 0 cleanly.

Tests

• TestMarkValidatorForDeletion_JailedRemoval_KeepsValidatorReachable
• TestMarkValidatorForDeletion_NonJailedRemoval_KeepsDelegatorShares

Both fail on current release/v0.53.x and pass with the fix.

Context

Surfaced while implementing simulation/fuzz testing for inference-chain (gonka-ai/gonka#982); filed with a standalone reproducer as gonka-ai/gonka#1205.

Independent of and complementary to GON-191 (#14, @0xgonka) — a different function (markValidatorForDeletion) than GON-191's (filterBasedOnExisting / deleteValidatorInternal). The two were verified to compose without conflict (full simulation pass with both patches, height=501); coordination on #14: #14 (comment). In that thread @0xgonka confirmed the non-jailed divide-by-zero (#2 above) and recommended fixing it in this PR (identical fix shape).

cc @gmorgachev — fork maintainer and author of markValidatorForDeletion (both branches changed here: the jailed delete in cefc31d3a8e, the non-jailed DelegatorShares zeroing in 0d28c0a1e2e)