Filter forced-to-leave nodes from TSS keygen and GG20/ECDSA keysign

Note: The branch name is historical and misleading. This MR does not handle jailed nodes, it only handles forced-to-leave nodes.

Summary

This MR prevents forced-to-leave nodes from receiving new TSS keygen membership and excludes forced-to-leave vault members from normal GG20/ECDSA TSS keysign parties.

What changed

• exclude forced_to_leave node accounts from new keygen membership so they do not receive fresh vault key material
• filter vault keysign parties through current node account state so forced-to-leave vault members are not invited to GG20/ECDSA signing
• • add DisableTSSSignerFiltering Mimir as an emergency fallback that makes Bifrost return raw vault membership instead of the filtered signer set
• • keep DisableTSSSignerFiltering on the economic Mimir path, so disabling this guard requires active-validator supermajority rather than OperationalVotesMin
• keep the TSS threshold based on the original vault size, even when unsafe members are filtered out
• let excluded local nodes return ErrNotActiveSigner and skip signing without posting a keysign failure
• pass the not-active-signer path through EVM, UTXO, Gaia, TRON, XRP, and signer code
• add CompromisedVault-<pubkey> operational Mimir to stop normal ECDSA signing for a flagged vault
• keep keygen self-check signatures on the local-state party path because the new vault is not stored on thornode yet
• add forced-to-leave simulation coverage for both keygen and keysign paths
• include mocknet simulation stability fixes needed for those longer simulation runs

Mimir controls

• CompromisedVault-<pubkey>: operational Mimir. When set to a positive value, Bifrost stops normal ECDSA signing for that vault before opening a join party.
• DisableTSSSignerFiltering: economic Mimir. When set to a positive value, Bifrost disables the new forced-to-leave signer filtering and returns raw vault membership from GetKeysignParty. This is intentionally not operational because it disables a guard against the keysign exploit.

What this MR does not do

• It does not handle jailed nodes. Jail state is not used when selecting keygen members or GG20/ECDSA keysign parties.
• It does not change non-GG20/ECDSA signing paths such as EdDSA and FROST.
• It does not lower the vault signing threshold after filtering forced-to-leave members.
• It does not replace filtered members with backup signers; if the remaining signer set cannot satisfy the original threshold, signing fails or stands down.
• It does not change existing vault membership or on-chain vault state.

Validation

• make test
• make test-simulation
• make test-simulation-cluster