HotStuffMaintenanceSource

Reads operator/drain targets and the actual trusted local finalization tracker. Remote heights, proposal heights, and clock estimates must never be substituted for that tracker. A restart derives the target from the retained drain command and reads finalized proof state before enabling the provider.