docs: warn that the msgs-only single-block allowlist entry rests on is_first_block (A-1375)

The message-only block root is listed in the single-block checkpoint-root allowlist only for symmetry;
today the inputs validator's is_first_block assertion is the sole reason it cannot stand as a checkpoint's
only block. Note that if that assertion is ever relaxed, this entry must be dropped in the same change, so
the two decisions are not made independently.

Author: spalladino

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/checkpoint_root/checkpoint_root_single_block_rollup.nr

@@ -18,6 +18,11 @@ use types::{
 // If there's only one previous rollup (i.e., one block in the checkpoint), it must be a first block root: the inputs
 // validator asserts the leftmost rollup's `is_first_block`. The message-only block root sets `is_first_block = false`,
 // so it is listed here (for symmetry with the multi-block variant) but can never actually pass as the sole block.
+//
+// That `is_first_block` assertion is the only thing keeping a message-only block from standing as a checkpoint's sole
+// block. If it is ever relaxed (e.g. replaced by a "leftmost block's start_msg_sponge is empty" check), this entry
+// must be dropped in the same change, or a transaction-less single-block checkpoint — one whose blob omits the
+// first-block l1-to-l2 root — would silently become provable.
 global ALLOWED_PREVIOUS_VK_INDICES: [u32; 4] = [
     BLOCK_ROOT_FIRST_ROLLUP_VK_INDEX,
     BLOCK_ROOT_SINGLE_TX_FIRST_ROLLUP_VK_INDEX,