ci: run the dind jobs in the prebuilt tools image

Verified the ci/tools:2 digest pulls and has every tool plus Go 1.26.9. CI lint returned 403 here, so that line stays tied to the earlier dry run. Here's the description:

Follow-up to !5142 (merged), now merged (squash 10d7608006).

ci/tools:2 is published: develop's build-ci-tools-image job 17066463046 built it from the current ci/Dockerfile.ci-tools (Go 1.26.9) and pushed sha256:29b5fe763a4b6fd27e5f7a19c8744e1f9dc39870dcb6ac571661d44cbb5d0e7c. CI_TOOLS_IMAGE pins that digest (ci/tools:2@sha256:29b5fe76…). Any Developer's CI_JOB_TOKEN can push to this registry. With the digest pinned, a replaced tag fails to pull instead of running in build-thornode, which holds the release-image push credentials. This MR first pinned ci/tools:1 (sha256:7b82d617…), but that image was built from golang:1.26.4. That is below go.mod's toolchain go1.26.9, so every job still downloaded the toolchain.

Change

• generate, the proto jobs (format check, lint, breaking check), build-thornode/thorscan/events and test-mocknet-scripts now run in $CI_TOOLS_IMAGE (ci/Dockerfile.ci-tools). Before, they ran apk add against dl-cdn.alpinelinux.org on every job, which caused 38 failures from 2026-09-14 to 09-28. The image comes in through the shared .use_dind anchor and the image: on test-mocknet-scripts. test-simulation and test-regression keep their own images.
• The jobs that installed Alpine's go no longer download the go.mod toolchain from proxy.golang.org, because the image ships Go 1.26.9. With GOTOOLCHAIN=auto that version is a floor, so a later toolchain bump downloads the newer Go instead of breaking these jobs. The GOTOOLCHAIN comment is updated to match.
• CI_TOOLS_IMAGE is pinned by digest, as above. A new tools image means bumping CI_TOOLS_VERSION, letting develop publish it, and then pinning the digest it prints ("Pin jobs to: ...").
• build-ci-tools-image overrides the anchor's image and stays on plain docker:28.5.2, so a missing or broken tools image can always be rebuilt.
• Cherry-picks a regression golden regen (2c3dca68, from itz/regtest-fixture-regen-s09). On develop, b8b111b5fc (S09) added the xmr_mined_height ObservedTx field but did not regenerate adv-swap-queue/rapid-swaps-failed-market-budget.json, so test-regression fails with "blocks differ". The regen adds the field to that file's 3 ObservedTx and changes nothing else.

Validation

• CI lint (dry run on develop, before the ci/tools:2 pin): valid, no warnings.
• The published ci/tools:2 image, pulled by the pinned digest, has bash, python3, jq, make, git, protoc, curl, wget, sed, find and Go 1.26.9.
• The image builds locally with every tool the removed apk add lines installed, and build/scripts/tests passes in it (38 tests).

🤖 Generated with Claude Code