[justinkaseman]

Makes ProposeJobSpec.VerifyPreconditions check that each target node’s OCR2 key bundle in JD matches an expected onchain signer before a job spec is proposed.

Applies to OCR3, Consensus, Ring, EVM, Aptos, Solana and Stellar.

• EVM: the bundle ID must be non-empty and its signer must match.
• Non-EVM: the bundle must be present, with a non-empty ID not shared between nodes.

Why

A stale JD chain config, for example after a key rotation, would bake the wrong bundle ID into the spec.

CLD Follow up

• Update ProposeJobSpecResolver to fill expected signers
• Add skipKeyringCheck to the resolver input and pass it through
• Reject an empty expectedSigners map in the resolver. Otherwise an environment with no signers silently skips the check.

[github-actions]

👋 justinkaseman, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[github-actions]

✅ No conflicts with other open PRs targeting develop