staking-async: allow session keys handling on AssetHub

[sigurpol]

• Validators can now call set_keys and purge_keys on AssetHub, which forwards the request to the RelayChain via XCM.
• Session keys and ownership proof are validated on AssetHub before forwarding. Only validated keys are sent to RC (no proof), as RC trusts AH's validation.
• Staking proxies can call set_keys and purge_keys on behalf of validators. The ProxyType::Staking filter on runtime needs to be updated to include these calls.
• Validators are still allowed to call set_keys and purge_keys via relay-chain pallet-session's extrinsics. This option will be deprecated in the future.
• No key deposit is required on AssetHub.

Close #8806.

TODO

• integration test to check AH-RC key consistencies
• proper benchmarking (e.g. around ownership proof now that frame-session: Introduce a proper proof of key ownership #1739 is merged)
• re-generate weights for staking-async-rc-client
• should we use a bonded vector for proof of ownership on AH? We will never forward it to RC but still...

[sigurpol]

/cmd prdoc --audience runtime_dev --bump major

[Ank4n]

why can't we directly xcm::transact session pallet call?

[sigurpol]

my understanding - which might be wrong - is that if we use xcm::transact directly to call pallet_session::set_keys, then RC has no way to know that the transaction was signed by validator X, the origin would be just the XCM origin (Parachain(1000) or something) and pallet_session::set_keys requires ensure_signed(origin) so it would need the account of X. so ensure_origin would fail because it would find AH as origin and not X.

ah-client solves the issues :

  pub fn set_keys_from_ah(
      origin: OriginFor<T>,
      stash: T::AccountId,    // ← X's account passed explicitly!!!!!!
      keys: Vec<u8>,
      proof: Vec<u8>,
  ) {
      T::AssetHubOrigin::ensure_origin(origin)?;  // we verify it's from AssetHub

      T::SessionInterface::set_keys(&stash, keys)?;  // ← Use stash  of X directly calling pallet_session::Pallet::<T>::do_set_keys(account, keys)
  }

Note that RC relies on AH to have verified that the transaction is signed by X

 pub fn set_keys(origin: OriginFor<T>, keys: T::Keys, proof: Vec<u8>) -> DispatchResult {
      let stash = ensure_signed(origin)?;  // ← we check it is signed by validator X

Does it make sense?

[sigurpol]

Main outcome of discussion with @Ank4n :

• fire and forget when setting / purging keys from AH to RC
• raw bytes as keys
• it's ok to have a transition period where we allows keys to be set / purged both on AH and RC to have an easy transitions for validators / tools. We will deprecated and remove RC extrinsics later on

[paritytech-workflow-stopper]

All GitHub workflows were cancelled due to failure one of the required jobs.
Failed workflow url: https://github.com/paritytech/polkadot-sdk/actions/runs/20483170037
Failed job name: test-linux-stable

[sigurpol]

/cmd bench --pallet pallet_staking_async_rc_client --runtime asset-hub-westend

[github-actions]

Command "bench --pallet pallet_staking_async_rc_client --runtime asset-hub-westend" has started 🚀 See logs here

[github-actions]

Command "bench --pallet pallet_staking_async_rc_client --runtime asset-hub-westend" has finished ✅ See logs here

Details

Subweight results:

File	Extrinsic	Old	New	Change [%]
substrate/frame/staking-async/rc-client/src/weights.rs	set_keys		175.00us	Added
substrate/frame/staking-async/rc-client/src/weights.rs	purge_keys		35.00us	Added
cumulus/parachains/runtimes/assets/asset-hub-westend/src/weights/pallet_staking_async_rc_client.rs	set_keys		416.75us	Added
cumulus/parachains/runtimes/assets/asset-hub-westend/src/weights/pallet_staking_async_rc_client.rs	purge_keys		100.98us	Added

Command output:

✅ Successful benchmarks of runtimes/pallets:
-- asset-hub-westend: ['pallet_staking_async_rc_client']