Defer live EVM logs until confirmed canonical backfill #1661

Audit reference: I17

What can go wrong

Live subscription logs were delivered immediately, bypassing the configured confirmation depth and allowing a later chain reorganization to invalidate work the node had already accepted.

When it happens

The race is present during and after startup whenever a websocket subscription sees a tip log before canonical backfill reaches the confirmed block.

What changed

Subscription logs are now wakeups only; confirmed canonical backfill is the sole path that delivers EVM events.

Why the change works

Every delivered event passes through the same confirmation and ordering rules, regardless of whether a live subscription first noticed it.

Checks

The confirmed-backfill deferral regression passes.