fix(bifrost): S05A - add fail-closed XMR scanner activation control

Series context

This is S05A of the focused replacement MRs for the superseded XMR MR !4983 (closed).

• Scope: Bifrost-only XMR economic-scanner activation control
• Depends on: S00(!5026)
• Merge: S00(!5026) into develop -> rebase/retarget & merge this MR S04A.
• Intended target: zly/s00-frost-keygen-liveness; retarget to develop after S00 merges
• Related:
  • S00 owns FROST ceremony admission, keygen reliability, and the shared simulation prerequisites
  • S05B (!5046) provides membership and single-active-monovault lifecycle regression coverage
  • S06–S08 cover signer startup, deployment hardening, and scanner recovery

S05A inherits S00(!5026) so the combined simulation can create an XMR vault before exercising scanner activation. Its own diff remains limited to scanner and spent-reference catch-up controls. It does not duplicate keygen implementation or change the FROST wire protocol.

The additional THORNode keygen gate proposed as S05C was rejected. S05D’s churn-clock audit is complete, with the contained delay accepted rather than changed.

Problem

XMR key generation and XMR economic activation must be separable.

After the monovault becomes active, operators need to keep XMR block scanning and spent-reference catch-up disabled until the reviewed fleet is ready. Using HaltXMRChain is too broad because its chain-halt behavior can interfere with global churn.

The scanner control must fail closed: deploying a scanner-capable build must not implicitly enable observations when its Mimir is absent or temporarily unreadable.

Development topologies must also enable scanning explicitly so their post-deploy flows can receive the expected observations.

Changes

Add the XMR scanner control

• Add the Bifrost-only HaltScannerXMR switch.
• Gate XMR block scanning and spent-reference catch-up with the same switch.
• Leave non-XMR scanners unchanged, without issuing the new lookup.
• Preserve existing chain, solvency, global, and node-pause checks.

Mimir result	XMR scanner behavior
Lookup error	Paused
Missing or negative	Paused
Exactly 0	Scanner gate open; existing pause checks still apply
Positive	Paused

Keep development deployments usable

• Default HALT_SCANNER_XMR to 0 in the base mocknet Compose configuration.
• Add the same explicit default to the standalone mocknet-built XMR stagenet topology.
• Set HaltScannerXMR=0 in the chainnet post-deploy flow before waiting for XMR fee and chain-tip observations.

Production behavior remains fail-closed.

Document operational behavior

Document the switch in the Mimir and network-halt references, including that it:

• affects Bifrost XMR block scanning and spent-reference catch-up,
• does not control keygen admission,
• does not enter THORNode’s chain-halt path or pause churn,
• does not set the inbound-address halted field.

Use Bifrost /status/scanner to monitor scanner progress. It reports the symptom rather than the specific pause reason: an unset key logs at Debug level, while lookup failures log at Error level.

Compatibility and rollout

S05A’s own changes introduce no consensus, persisted-state, API, or wire-format change. The complete stacked branch inherits S00’s separate compatibility and release requirements, including its consensus-sensitive changes; it must not be treated as a Bifrost-only backport.

Keep HaltScannerXMR positive until the economic-activation checklist is complete, then explicitly vote it to 0. Removing the key does not enable scanning.

After S00 merges, replay only S05A’s own changes onto develop and retarget this MR.