fix(tests): probe the actual CREATE target on nonce overflow

[danceratopz]

🗒️ Description

test_aborted_create_does_not_warm_address checks that a silently aborted CREATE does not warm the would-be contract address. The nonce_overflow case deployed the factory with nonce 2**64 - 1 but pointed the BALANCE probe at compute_create_address(address=factory, nonce=1).

A plain CREATE derives its target from the factory's nonce at CREATE time, so for this factory the address uses nonce 2**64 - 1, not 1. In the spec, generic_create runs the nonce-overflow check before adding the target to accessed_addresses, so a client that incorrectly warmed the target before rejecting the overflow would warm the nonce 2**64 - 1 address. Because the probe pointed at an unrelated, never-touched address, it stayed cold on both correct and buggy clients: The CREATE branch could pass without exercising the intended address.

CREATE2 was unaffected, since its address is nonce-independent.

Fix

Thread a single factory_nonce (2**64 - 1 for nonce_overflow, 1 otherwise) through both the factory deployment and the compute_create_address probe, so the deploy nonce and the probe nonce cannot drift. The CREATE2 derivation is unchanged, since its address is nonce-independent.

Trace verification

Filled with --traces on Amsterdam and inspected the t8n execution trace for the CREATE + nonce_overflow case, before and after the fix. The factory is identical in both runs (deployed with nonce 2**64 - 1) and the CREATE aborts at depth 1 with no child frame, so the only behavioral change is the address the BALANCE probe reads:

• Before: BALANCE targets 0x04bb...5a2b, which is compute_create_address(factory, 1), an address unrelated to the creation. Charged cold (3000), so the assertion held vacuously.
• After: BALANCE targets 0x79fa...1c77, which is compute_create_address(factory, 2**64 - 1), the address the CREATE would have produced. Charged cold (3000), confirming the aborted CREATE did not warm it.

The cold 3000 charge is identical in both runs, which is why the green fill alone never caught the bug: only the probed address distinguishes them.

🔗 Related Issues or PRs

Fix-up to ethereum#3033 (EIP-8038 state-access gas-cost test suite), which introduced this test.

[marioevz]

LGTM. The suggestions are purely cosmetic so feel free to apply or merge without them.