Add Validate proxy support to runtime and Python SDK

[cisterciansis]

Summary

• add ProxyType::Validate with stable on-chain ID 18
• restrict Validate proxies to validator operations: weight set/commit/reveal calls, axon serving, EVM association, and commitments
• preserve existing subnet set_weights call sites by configuring the exact weight hotkeys on the client
• support any ordering and mixture of the signing hotkey and proxied hotkeys, including an explicit empty set that performs no submission
• verify proxied targets on-chain, build each call against the real hotkey identity, and submit the configured calls atomically

Attribution

This work carries forward the original ProxyType::Validate runtime design and test groundwork from #2543, authored by @ppolewicz. Thank you to Paweł Polewicz for proposing and implementing the original scoped validator proxy.

This PR adapts that work to the current monorepo proxy-filter metadata model and adds the previously missing Python SDK integration.

Why

A validator operator may be authorized by several hotkeys to compute one weight vector and submit it for each validator. The runtime needs a narrow proxy role that cannot transfer value or manage stake. For commit-reveal subnets, the SDK must also preflight and timelock-encrypt against each real validator hotkey rather than the delegate key.

Unlike #2543, Validate proxies in this version cannot create additional proxies; each validator owner grants the delegate directly.

SDK behavior

Existing subnet weight-setting code does not change. The client owns the target configuration:

client = bt.Client(
    weight_targets=[
        delegate_wallet.hotkey.ss58_address,  # direct
        validator_a,                          # Validate proxy
        validator_b,                          # Validate proxy
    ]
)

await client.execute(
    bt.SetWeights(netuid=1, weights={0: 0.2, 1: 0.8}),
    delegate_wallet,
)

weight_targets is authoritative when supplied:

• the supplied wallet hotkey is a direct target
• every other target must have granted that hotkey a zero-delay Validate proxy
• targets may appear in any order
• weight_targets=[] returns a successful no-op without signing, submitting, or paying a fee
• omitting weight_targets (None) preserves the existing single-wallet behavior

The SDK validates addresses and duplicates at client construction, verifies all proxied grants with block-pinned Proxy.Proxies point reads, and fails closed before submission if configuration and chain state differ. It does not scan the global proxy map or accept unsolicited delegations.

The configured calls are wrapped in one Utility.batch_all extrinsic and signed once by the supplied hotkey, so they succeed or fail together. Plaintext and timelocked commit-reveal paths both preflight and build against the real validator identity.

A single extrinsic has one signer, so the supplied wallet is intentionally the only possible direct signer in one execution. Other configured addresses are proxied targets.

Validation

• cargo test -p subtensor-runtime-common --lib — 10 passed
• SKIP_WASM_BUILD=1 cargo test -p node-subtensor-runtime proxy_filters --lib — 14 passed
• full Python SDK suite with the lockfile frozen — 1,072 passed, 1 skipped
• mixed direct/proxied ordering regression — passed
• explicit empty-target no-op regression — passed
• stale or missing proxy grant fail-closed regression — passed
• Ruff lint and format — passed
• SDK typecheck — no error-level diagnostics
• call coverage, error-name, and unit consistency checks — passed

Local environment note

The native WASM build could not run locally because Apple clang lacks a wasm32 backend for the zstd C build.

[vercel]

@cisterciansis is attempting to deploy a commit to the RaoFoundation Team on Vercel.

A member of the Team first needs to authorize it.