Release 3.20.2 — SOL keysign determinism + PIE + bootstrap-peer + hotfix backport (board 717)

Release 3.20.2 (mainnet) — non-consensus-breaking patch on 3.20.1

⚠️ DO NOT MERGE / TAG / RELEASE without explicit per-action OK. For review + co-sign.

Brings the public mainnet branch (currently 3.20.1, 9ef7c9bb) up to 3.20.2. Patch release — network consensus version stays 3.20.0; app/upgrades.go registers standard.NewUpgrade("3.20.0") (matches develop; the empty-Upgrades variant that crash-looped stagenet v1 is not used here).

Cherry-pick set (onto origin/mainnet 9ef7c9bb)

6caf8dfc  feat(bifrost/sol): deterministic SOL keysign blockhash (!5041)
eaa50205  build: compile thornode as a PIE (!5060)
c2116ee2  fix(bifrost): bound TSS bootstrap-peer wait (!4994)
e7420101  Backport 3.20.0/3.20.1 hotfix lineage from thornode-private (d891cef)
717a30bf  bump cosmos/iavl to v1.2.8 (dcc86e5)
d1a574fd  Release 3.20.2  (version 3.20.1 → 3.20.2)
e6c6476c  chore(openapi): regenerate openapi/gen (make-generate gate)
1a102d1d  ci(proto): run proto-check-breaking against the MR target branch, not develop
857d15b8  release: bump openapi.yaml to 3.20.2 + regenerate openapi/gen (fix lint docs-version)

No [stagenet]-specific commits — those (TCY/RouterV6.1/address-rotation) stay on the stagenet lineage.

Consensus-affecting changes carried in (from the d891cef1 backport)

• noop:novault mimir gate — noop vault debits are now gated behind a chain-scoped mimir (bb6246c1). Consensus-relevant.
• reference-memo inbound guard — re-applies the inbound guard to resolved reference memos (760c40a1). Consensus-relevant.
• streaming-swap price-limit DoS bound in parseTradeTarget (memo parsing).

Security reconciliation vs thornode-private/mainnet

tc-vals flagged private/mainnet ahead with 5 security fixes. All 5 are present in this cut (via the d891cef1 backport, verified at content level):

• ✅ TSS-077 deterministic missing-share blame
• ✅ scheduler EndBlock chain-halt guard (recover() in scheduled exec)
• ✅ streaming-swap price-limit DoS bound — stronger here (also rejects Inf/negative, not just >256)
• ✅ attestation frames packed by bytes (not item count)
• ✅ TSS MaxPayload — cap stays 20 MB (the 512 KB lowering was reverted upstream, d1cc703e); the actual change is write-side enforcement of the cap (b01620e3)

Only expected difference vs private/mainnet: the private-only CI registry redirect (DOCKER_REGISTRY → thornode-private), correctly absent from this public cut.

Verification

• app/upgrades.go byte-identical to develop (registers 3.20.0). version = 3.20.2; openapi/openapi.yaml = 3.20.2 (lint docs-version match).
• make build TAG=mainnet compiles clean (-tags mainnet -buildmode=pie); make generate clean.
• proto-check-breaking now runs against the MR target branch (mainnet), so develop-only additions aren't misreported as deletions.
• Same content validated green on stagenet CI (pipeline 2831015624) and running healthy on stagenet (a84cd2b5).