Allow the Staking proxy to call claim_root

[yeuyeuh]

Description

Root dividends only materialize through claim_root. But claim_root sits in RootClaimCalls, which the Staking proxy type cannot reach — so a Staking-proxy setup silently stops realizing root rewards, and coldkeys must sign a second RootClaim delegation for a right they already meant to delegate.

If a coldkey has set a Staking proxy, that's an explicit signal of trust that the proxy manages its stake positions — which includes realizing their rewards. claim_root is strictly benign in the Staking threat model: it can only restake the payout on root for the same coldkey; no value can leave the account.

Changes:

• runtime/src/proxy_filters/mod.rs: StakingAllowed = (StakeManagementCalls, RootClaimTypeCalls, RootClaimCalls) — RootClaimCalls added, RootClaimTypeCalls untouched
• proxy inventory test updated (narrow_proxies_have_exact_allow_lists now expects SubtensorModule::claim_root for ProxyType::Staking, alongside set_root_claim_type)
• docs/guides/proxies.mdx: the Staking bullet now lists claim_root next to set_root_claim_type

Related Issue(s)

• None

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Other (please describe):

Breaking Change

Not breaking: it widens the Staking proxy allowlist with one benign call. Existing delegations keep working unchanged; no migration needed. NonTransfer / NonCritical / NonFungible already include RootClaimCalls, so all superset relations still hold (verified by superset_relations_match_allowed_call_sets).

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• Formatting verified with cargo fmt --all -- --check (clean). ./scripts/fix_rust.sh was not used because it auto-commits, which would have added noise commits to this branch.
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes (see note below)
• Any dependent changes have been merged and published in downstream modules

Screenshots (if applicable)

N/A

Additional Notes

Rebased onto main (was targeting release-v438). The branch now carries a single commit on top of main.

cargo test -p node-subtensor-runtime --lib proxy_filters has 4 pre-existing failures on main, unrelated to this PR: AdminUtils::sudo_set_emission_bar_quantile and AdminUtils::sudo_set_emission_gate_exponent are not registered in any proxy call group, so all_call_groups_cover_runtime_call_metadata fails, and the three broad-proxy inventory tests (non_transfer_*, non_fungible_*, non_critical_*) cascade from it. The tests this PR touches all pass: narrow_proxies_have_exact_allow_lists, superset_relations_match_allowed_call_sets, non_transfer_superset_is_explicit_allowlist.

Happy to open a separate PR registering those two admin calls if that's useful.

[vercel]

@yeuyeuh is attempting to deploy a commit to the RaoFoundation Team on Vercel.

A member of the Team first needs to authorize it.

[UnArbosSix]

needs to target main branch

[yeuyeuh]

Rebased onto main as requested — the branch now carries a single commit on top of main (2 files, +8/-3), and I've updated the description to match.

One thing worth flagging in the conflict resolution: release-v438 had dropped set_root_claim_type, so the original commit replaced RootClaimTypeCalls with RootClaimCalls in the Staking allowlist. On main that call still exists, so the allowlist now adds rather than replaces:

type StakingAllowed = (StakeManagementCalls, RootClaimTypeCalls, RootClaimCalls);

The docs change follows the same logic — claim_root is listed next to set_root_claim_type, not in place of it.

Heads-up on CI: all_call_groups_cover_runtime_call_metadata already fails on main because AdminUtils::sudo_set_emission_bar_quantile and sudo_set_emission_gate_exponent aren't registered in any proxy call group, which cascades into the three broad-proxy inventory tests. Unrelated to this PR — this branch doesn't touch call_groups.rs. Happy to open a separate PR for it.

[yeuyeuh]

@UnArbosSix ready for another look when you have a moment.