Node 10.7.0: add kes-agent, dmq-node, lsm opts, db-tools ci, OCI cleanup

[johnalotoski]

Summary

• Bump iohkNix. Update MinNodeVersion to 10.7.0 and refresh mainnet-peer-snapshot.json and other ci files.
• LSM backend: Add independent lsmDatabasePath NixOS option with uniqueness assertion and mutual-exclusion check against LMDB per instance.
• Release bins: Add kes-agent/kes-agent-control (Linux only) and dmq-node (all platforms) to release binaries.
• Add cardano-node-dbtools NixOS test covering db-synthesizer, db-analyser, db-truncater, and the GHC-asserted synthesizer binary against a cardano-testnet create-env environment.
• Add --shelley-kes-agent-socket support to run-node and cardano-node-service.nix. Expand the KES assertion to cover three valid forging configurations: relay (none), direct KES key, and KES agent socket. Add
  CARDANO_TRACER_SOCKET_NETWORK_{ACCEPT,CONNECT} tracer socket options to run-node.
• OCI images: Harden all node and tracer entrypoint/launch scripts with set -euo pipefail, safe ${VAR:-} expansion throughout, pre-flight file existence checks, and exec for clean process replacement. Consolidate separate relay/block-producer run functions into a single runNode. Derive GENESIS_JSON from CARDANO_CONFIG directory to support non-mainnet deployments.
• Misc: Rename runCommandNoCCLocal → runCommandLocal for nixpkgs 25.11.

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• New tests are added: checks/nixosTests/cardanoNodeDbtools
• CI passes for PR content -- remaining CI errors are unrelated to contents of this PR
• Self-reviewed the diff

[mgmeier]

LGTM

[snarlysodboxer]

Reviewing just the SRE related commits via 2dc9c2a...jl/10.7.0-sre, LGTM!

[snarlysodboxer]

LGTM