COINBASE_MATURITY=30 + L2 /submit stops mutating SMT

Bitcoin uses COINBASE_MATURITY=100 (you can’t spend a coinbase output until 100 blocks deep). With our 1-minute target block time, that’s 100 minutes of waiting before mining rewards become spendable. Cut to 30 for a smoother dev/UX experience. Still safe — the reorg history on Vanta is dominated by 1-deep reorgs.

Bigger fix in the same commit: the L2 /submit endpoint was mutating the sparse Merkle tree even on validation failure, leaving us with phantom commitments that no proof could ever spend. Now it builds the candidate state, runs every check, and only mutates after validate_v2() returns true.