Cardano Updates

This will be emitted whenever the forge decision logic decides to
include a certificate in a block body.

Replace the central decsision thread by having server threads coordinate
between them by blocking on STM actions.

OpenDatum.accumulatorHash is only updated by on-chain Increment and
  Decrement transactions. Regular L2 snapshots are off-chain and never
  touch the Open datum, so the field is stale for any head that has
  processed L2 transactions.

Aligns with the Piranha Cluster branding already used by net-ui.
Mechanical rename across:

- .github/workflows/net-node-docker.yaml — IMAGE env, job name, cache scope
- net-rs/docker/Dockerfile — local build-tag comment
- net-rs/docker/README.md — title, build/run examples, container --name
- net-rs/docker/relay.toml — header comment
- net-rs/README.md — one-line pointer in the Building section

No code changes; only image/tag identifiers and prose. Published
image will be ghcr.io/<owner>/<repo>/piranha-relay.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

New workflow modelled on antithesis-leios.yaml:

- Triggers: push to main (path-filtered), workflow_dispatch (manual,
  with optional push_image flag for testing the workflow itself).
  No pull_request trigger — multi-arch QEMU builds are slow and we
  rely on local docker build for PR-level Dockerfile validation.
- Image: ghcr.io/<owner>/<repo>/leios-net-node.
- Platforms: linux/amd64 + linux/arm64. Arm64 via QEMU on the
  amd64 runner; adds 10-15 min vs. amd64-only but keeps the workflow
  to a single job.
- Tags: type=sha, type=ref,event=branch, plus `latest` on the default
  branch. (No type=ref,event=pr since PRs don't run this workflow.)
- Cache: GHA scope=leios-net-node so net-node + shared-rs Rust compile
  artifacts persist across runs.
- Auth: secrets.GITHUB_TOKEN with packages: write — same pattern as
  antithesis-leios.yaml.

First publish will create the GHCR package as private (repo default);
flip visibility manually from Settings -> Packages after the first
push to main lands.

Action SHAs pinned to the same versions used in antithesis-leios.yaml.
docker/setup-qemu-action is left at @v3 with a TODO to SHA-pin.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

net-node: docker image for single Leios-enabled relay

Co-authored-by: sg-doc-holiday[bot] <219201796+sg-doc-holiday[bot]@users.noreply.github.com>

Addresses all review comments from PR #6580 (mgmeier). The root cause of
most issues was that `Cardano.Tracing.HasIssuer` was incorrectly deleted
as part of the iohk-monitoring cleanup

PR #904 introduced the Dockerfile, entrypoint and relay.toml but
documented the build/run contract only in the Dockerfile's own header
comment. Adds a focused docker/README.md with:

- Build command (and the BuildKit / docker-buildx prerequisite).
- TOML config layering — mainnet.toml -> relay.toml -> env overlay
  -> optional NET_NODE_CONFIG.
- Environment-variable table (port, peers, id-validation rule,
  config path, RUST_LOG).
- Run examples for the common shapes: standalone relay, user overlay
  via bind mount, non-default port.
- Container hygiene notes (non-root leios user, EXPOSE 3001,
  signal handling, overlay write path).

net-rs/README.md gains a one-line pointer to the new doc next to the
existing "Building" section.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>