Merge commit from fork

The epoch duration subtraction in get_block_epoch was unchecked.
A miner can craft a chain where the previous epoch tail has a higher
timestamp than the next epoch tail (consensus-valid since only median-time
is enforced, not monotonicity). The unchecked subtraction then underflows
in release builds (overflow-checks = true), causing a panic.

Using saturating_sub yields 0 for non-monotonic timestamps, which the
downstream next_epoch_ext already clamps to at least 1 second via
cmp::max(epoch_duration / 1000, 1).

Author: eval-exec

traits/src/epoch_provider.rs

@@ -33,11 +33,11 @@ pub trait EpochProvider {
                         .get_block_ext(&last_block_hash_in_previous_epoch)
                         .expect("stored block ext")
                         .total_uncles_count;
-                let epoch_duration_in_milliseconds = header.timestamp()
-                    - self
-                        .get_block_header(&last_block_hash_in_previous_epoch)
+                let epoch_duration_in_milliseconds = header.timestamp().saturating_sub(
+                    self.get_block_header(&last_block_hash_in_previous_epoch)
                         .expect("stored block header")
-                        .timestamp();
+                        .timestamp(),
+                );
 
                 BlockEpoch::TailBlock {
                     epoch,