fix: reject the zero address in initializers and setters

AlignedLayerServiceManager and BatcherPaymentService both validate every
address they are initialized with, but AlignedProofAggregationService
validates none of them. A zero newOwner there permanently disables
_authorizeUpgrade and every setter, with no way back.

Apply the same InvalidAddress check the sibling contracts already use:

- AlignedProofAggregationService.initialize: newOwner,
  alignedAggregatorAddress, sp1VerifierAddress, risc0VerifierAddress
- setSP1VerifierAddress and setRisc0VerifierAddress, which would otherwise
  point verification at an empty address
- BatcherPaymentService.withdrawFromServiceManager: withdrawAddress, where
  transfer() to address(0) succeeds and burns the funds

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: 0xrlawrence

contracts/src/core/AlignedProofAggregationService.sol

@@ -54,6 +54,18 @@ contract AlignedProofAggregationService is
         bytes32 _risc0AggregatorProgramImageId,
         bytes32 _sp1AggregatorProgramVKHash
     ) public initializer {
+        if (newOwner == address(0)) {
+            revert InvalidAddress("newOwner");
+        }
+        if (_alignedAggregatorAddress == address(0)) {
+            revert InvalidAddress("alignedAggregatorAddress");
+        }
+        if (_sp1VerifierAddress == address(0)) {
+            revert InvalidAddress("sp1VerifierAddress");
+        }
+        if (_risc0VerifierAddress == address(0)) {
+            revert InvalidAddress("risc0VerifierAddress");
+        }
         __Ownable_init();
         __UUPSUpgradeable_init();
         _transferOwnership(newOwner);
@@ -152,13 +164,19 @@ contract AlignedProofAggregationService is
     /// @notice Sets the address of the Risc0 verifier contract
     /// @param _risc0VerifierAddress The new address for the Risc0 verifier contract
     function setRisc0VerifierAddress(address _risc0VerifierAddress) external onlyOwner {
+        if (_risc0VerifierAddress == address(0)) {
+            revert InvalidAddress("risc0VerifierAddress");
+        }
         risc0VerifierAddress = _risc0VerifierAddress;
         emit Risc0VerifierAddressUpdated(_risc0VerifierAddress);
     }
 
     /// @notice Sets the address of the SP1 verifier contract
     /// @param _sp1VerifierAddress The new address for the SP1 verifier contract
     function setSP1VerifierAddress(address _sp1VerifierAddress) external onlyOwner {
+        if (_sp1VerifierAddress == address(0)) {
+            revert InvalidAddress("sp1VerifierAddress");
+        }
         sp1VerifierAddress = _sp1VerifierAddress;
         emit SP1VerifierAddressUpdated(_sp1VerifierAddress);
     }

contracts/src/core/BatcherPaymentService.sol

@@ -194,6 +194,9 @@ contract BatcherPaymentService is
         uint256 amount,
         address withdrawAddress
     ) public payable onlyOwner {
+        if (withdrawAddress == address(0)) {
+            revert InvalidAddress("withdrawAddress");
+        }
         alignedLayerServiceManager.withdraw(amount); // reverts if InsufficientBalance
         // money is now in this contract
         // we transfer it to the withdraw address

contracts/src/core/IAlignedProofAggregationService.sol

@@ -61,4 +61,6 @@ interface IAlignedProofAggregationService {
     error InvalidProvingSystemId(uint8 actual);
 
     error ProvingSystemIdMismatch(uint8 expected, uint8 received);
+
+    error InvalidAddress(string param);
 }