Aztec Private Rollup Bridge Escape-Hatch Claim-Proof Drain

The attacker called the bridge's escape-hatch path with a proof whose public output named the attacker as recipient, causing the RollupProcessor to trust the forged output owner after verifier success and release 1158 ETH from bridge custody.