Two members of the same storage kind (global, local or box) with the
same key silently overwrote each other, for example through inheritance.
The compiler now reports an error naming both members.

Adds expected-output tests for the collision and for the cases that must
stay valid: the same key in different storage kinds, and distinct keys.

The previous release restores zstd-compressed snapshots; persist them
compressed from this one. A mainnet snapshot goes from 433 KB to
105 KB, for 0.75 ms to encode and 0.25 ms to decode, and it is written
twice per round. A rollback to the previous release restores these
snapshots; releases before it do not decode them and start the round
fresh, as they do for any snapshot they cannot decode.

The persisted state is mostly votes, and it holds their content several
times over: every vote carries the proposal value, the bundle that
proved a threshold repeats the signatures of the votes that formed it,
and msgpack writes every field name. zstd at level 3 removes the
repeats and keeps the signatures and proofs: a mainnet snapshot shrinks
from 433 KB to 105 KB.

This release restores a compressed snapshot, recognized by its frame
magic, and still persists the uncompressed form; the next release
persists the compressed form, so that the release before this one,
which does not decompress, restores what this one persists.

voteTracker held every accepted vote in Voters and again in
Counts[proposal].Votes. Since the previous release generates bundles
from Voters, the copies have no reader: stop maintaining them. Each
vote is about 780 bytes encoded and the copies went into every crash
recovery snapshot, about a third of a mainnet cert-step snapshot.

The field stays, omitted when empty, so that snapshots written by the
previous release still decode; it restores them with the copies, which
it does not read. Releases before the previous one would restore a
snapshot without the copies with incomplete bundles, so this change
ships one release after the bundle change.

genBundle built a threshold's bundle from Counts[proposal].Votes, a
second copy of the votes already held in Voters. Build it from Voters,
so that a persisted state without the per-proposal copies restores
with complete bundles; the next release stops persisting them. The
copies are still maintained here, so that a state persisted by this
release restores on the previous one.

Validate a restored vote tracker before using it: the counts must be
the weight of its voters, the equivocators count the weight of its
equivocators, and no sender in both maps. A state that fails is not
restored; the node starts the round fresh, as it does for a state it
cannot decode.

voteTracker held every accepted vote in Voters and again in
Counts[proposal].Votes. Since the previous release generates bundles
from Voters, the copies have no reader: stop maintaining them. Each
vote is about 780 bytes encoded and the copies went into every crash
recovery snapshot, about a third of a mainnet cert-step snapshot.

The field stays, omitted when empty, so that snapshots written by the
previous release still decode; it restores them with the copies, which
it does not read. Releases before the previous one would restore a
snapshot without the copies with incomplete bundles, so this change
ships one release after the bundle change.

genBundle built a threshold's bundle from Counts[proposal].Votes, a
second copy of the votes already held in Voters. Build it from Voters,
so that a persisted state without the per-proposal copies restores
with complete bundles; the next release stops persisting them. The
copies are still maintained here, so that a state persisted by this
release restores on the previous one.

Validate a restored vote tracker before using it: the counts must be
the weight of its voters, the equivocators count the weight of its
equivocators, and no sender in both maps. A state that fails is not
restored; the node starts the round fresh, as it does for a state it
cannot decode.

Non breaking changes to ARC60 to support PQ schemes. CAIP was also
removed and replaced with a security section noting that address auth is
non-trivial on Algorand due to rekeying. A future ARC that leverages
ARC60 can standardize SIWA

The persisted state is mostly the votes of the round's steps, and it
holds their content several times over: every vote carries the proposal
value, the bundle that proved a threshold repeats the signatures of the
votes that formed it, and msgpack writes every field name. zstd at
level 3 replaces the repeats with references and leaves the signatures
and proofs: a mainnet snapshot shrinks from 433 KB to 105 KB, for
0.75 ms to encode and 0.25 ms to decode. The snapshot is written twice
per round, so this removes most of the crash database's disk writes.

decode recognizes a zstd frame by its magic number and still reads the
uncompressed snapshots of earlier releases.