Filter jailed and forced-to-leave nodes from TSS keygen and ECDSA keysign

Closing in favor of !4857 (merged)

Relation to !4845 (closed)

This MR supersedes !4845 (closed). It keeps the forced-to-leave TSS protection from !4845 (closed) and extends it with jail-aware filtering: jailed vault members are excluded from the preferred signing party, but can be soft-included as deterministic fallback signers when clean members alone cannot satisfy the original vault threshold.

If this MR is approved and merged, !4845 (closed) can be closed in favor of this MR.

Summary

This MR keeps unsafe nodes out of new TSS work and makes Bifrost stand down cleanly when the local node is no longer part of the active ECDSA signing party.

It filters forced-to-leave and missing node accounts from new keygen/keysign membership, treats jailed members as fallback signers only when needed to preserve the original vault threshold, and adds Mimir controls for emergency operation.

What changed

• exclude forced_to_leave node accounts from new keygen membership so they do not receive fresh vault key material
• keep jailed keygen candidates as backup members only when clean nodes cannot satisfy the BFT minimum
• filter ECDSA vault keysign parties through current node-account state:
  • forced-to-leave members are never selected
  • missing node state is excluded
  • jailed members are used only as deterministic fallback signers when clean members are below the original vault threshold
• keep the TSS threshold based on the original vault size, even when unsafe members are filtered out
• pass THORChain height into ECDSA signing paths so jail release state is evaluated consistently across Bifrosts
• bucket ECDSA TSS tasks by rounded THORChain policy height
• let excluded local nodes return ErrNotActiveSigner and skip signing without posting a keysign failure
• pass the not-active-signer path through EVM, UTXO, Gaia, TRON, XRP, and signer code
• keep keygen self-check signatures on the local-state party path because the new vault is not stored on thornode yet
• add CompromisedVault-<pubkey> operational Mimir to stop normal ECDSA signing for a flagged vault
• add DisableTSSSignerFiltering economic Mimir to disable the new signer filtering and fall back to the old full-party behavior
• keep observer attestations on active-validator quorum rather than keysign-party quorum
• add forced-to-leave simulation coverage for both keygen and keysign paths
• include mocknet simulation stability fixes needed for longer forced-leave simulation runs

Validation

• make test
• make test-simulation
• make test-simulation-cluster (including forced-to-leave-keygen and forced-to-leave-keysign stages)