Add keysign-party API and jail-aware TSS signer filtering

Relation to !4845 (closed) and !4855 (closed)

This MR builds on the signer-filtering direction from !4845 (closed) and !4855 (closed). It keeps forced-to-leave protection, extends it with jail-aware fallback policy, and moves bifrost signer selection behind an explicit thorchain keysign-party API.

Summary

This MR keeps unsafe nodes out of new TSS work and makes bifrost stand down cleanly when the local node is not part of the active signing party.

It adds a /thorchain/vault/{pubkey}/keysign_party policy endpoint, filters vault signers through current node state at a rounded THORChain height, and propagates the resulting policy into bifrost ECDSA, EdDSA, FROST, Monero, and chain-client signing paths.

What changed

• add the keysign-party query/API/proto/OpenAPI response with:
  • active signers
  • never_signers
  • deterministic jailed_fallback_signers
  • original vault threshold
  • required_signers
  • active_signer_count
• exclude forced_to_leave node accounts from keygen/keysign membership
• keep requested-to-leave and leave-score nodes eligible until they are actually churned or forced out
• treat jailed vault members as fallback signers:
  • clean members are preferred
  • jailed members are promoted only when clean members cannot satisfy the original vault threshold
  • fallback order is deterministic by jail reason and pubkey
• keep the TSS threshold based on the original vault size, even when unsafe members are filtered out
• add DisableTSSSignerFiltering as an economic Mimir fallback that returns full vault membership
• fail closed for CompromisedVault-<pubkey> and do not allow full-membership fallback for compromised vaults
• keep compatibility by falling back to full vault membership when the new endpoint is unavailable
• pass rounded THORChain policy height into signing so bifrost nodes evaluate jail state consistently
• include PoolPubKey in ECDSA/EdDSA keysign msgID canonical data while keeping active signer set excluded
• keep observer quorum active-validator based, not keysign-party based
• make unselected bifrost signers stand down without posting keysign failure
• add forced-to-leave and jailed-fallback simulation actors
• include mocknet/simulation stability fixes needed by the longer signer-filtering runs

Mimir controls

• CompromisedVault-<pubkey>: operational Mimir. When set to a positive value, thorchain refuses to return a signing policy for that vault and bifrost must not sign from it.
• DisableTSSSignerFiltering: economic Mimir. When set to a positive value, signer filtering is disabled and bifrost falls back to full vault membership. This is intentionally not operational because it disables a guard against unsafe signer participation.

What this MR does not do

• It does not lower the vault signing threshold after filtering members.
  • The vault still uses the threshold derived from the original vault membership size. If a vault was 16-of-20, filtering does not turn it into something like 12-of-15. The policy must still find enough eligible signers to satisfy the original threshold.
• It does not mutate existing vault membership or on-chain vault state.
  • The API only returns a signing policy for a given vault. It does not remove members from the vault, update the vault object, or change stored membership. Forced-to-leave / jailed nodes are filtered only for TSS participation decisions.
• It does not include the active signer set in keysign msgID canonical data.
  • The msgID is not based on the filtered signer list. This avoids msgID differences if nodes disagree temporarily about the active signing party. The msgID includes stable signing data like messages, algo, pool pubkey, etc., but not the selected signer set.
• It does not change observer quorum to signer-party quorum.
  • Tx observation still needs quorum from active validators. It does not become “enough of the selected signers observed it.” Signing and observing are separate consensus concerns.

Validation

• make test
• make test-simulation
• make test-simulation-cluster (including forced-to-leave-keygen, forced-to-leave-keysign and jailed-keysign-fallback stages)