Patch-bump overlay-server, wallet-infra, and chaintracks-server for GHCR

[sirdeggen]

Keep this pull request in draft until local validation is complete. After
every push, wait for all applicable checks on the exact head to finish and
fix every failure before requesting review or calling the work complete.

Program and scope

• Tracker or issue: operator request to cut overlay-server, wallet-infra, and chaintracks-server releases from latest main
• Program gate(s) advanced: infrastructure image release (GHCR)
• Why this change is needed: GHCR tags overlay-server:v2.1.36, wallet-infra:v2.0.40, and chaintracks-server:v1.1.18 already exist from run 34538685770 at 6e53b215. infra-release.yaml treats those tags as immutable and skips them. Latest main includes #534 (auth policy, telemetry, payment ordering) and #536 (Mandala state authority). New patch versions are required before the workflow will build those bytes.
• Explicitly out of scope: message-box, UHRP, WAB; npm publication; deploying the images
• Exact head SHA reviewed: 1ccc064

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only
through the release workflow after approval):

• infra/overlay-server 2.1.36 → 2.1.37
• infra/wallet-infra 2.0.40 → 2.0.41
• infra/chaintracks-server 1.1.18 → 1.1.19

Generated docs/reference/stack-facts.md regenerated from those manifests.

Verification

• Local commands and results:
  • node scripts/generate-stack-facts.mjs --check — verified
  • pnpm docs:facts:check — passed
  • pnpm lint — 0 warnings, 0 errors
  • pnpm format:check — passed
  • pnpm health:check — local checkout also contains ignored .worktrees/ trees; hosted CI is the authority
  • pnpm typecheck — pre-existing conformance-runner missing @bsv/chirp dist without a full workspace build; unrelated to this diff
• Hosted CI run: pending after push
• Conformance evidence: not applicable (version metadata only)
• Coverage delta: none (no production source lines changed)
• Lint/typecheck delta: none
• Browser/mobile/packed-consumer evidence: not applicable
• Performance or bundle-size delta: not applicable
• I self-reviewed the complete diff for correctness, security,
  compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any
  scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and
  audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings
  (including accepted or false-positive issue states) and zero unreviewed hotspots;
  Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date,
  and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Lockfiles only update the root package version field to match package.json.
No dependency graph change.

Dependency evidence

• Release notes and necessity: n/a (no dependency change)
• Runtime, build, and peer compatibility: n/a
• Deduplicated lockfile: n/a
• Audit and CodeQL: pending hosted CI
• Package and consumer tests: n/a
• Bundle and performance impact: n/a
• Affected public package versions: none

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the
  controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

After merge, dispatch .github/workflows/infra-release.yaml from main. Discover
will queue only the three unpublished versions and skip the four already on GHCR.
Rollback is the previously verified digests:

• ghcr.io/bsv-blockchain/overlay-server@sha256:0122d12b4bb32c0aa181f6b30df178f1aeb185346c4a87b4e1415d6aeb51a043
• ghcr.io/bsv-blockchain/wallet-infra@sha256:5d8ee6154a72cb69eb3a5e6a4bd341d446d3004c635b0b0f09b91a66f00929c2
• ghcr.io/bsv-blockchain/chaintracks-server@sha256:f9cf7d0de526cc494b719d1a74afe28574d76a3ffc71598b8dd44f74fa5f287c

Completion evidence

• The linked tracker is updated only for work fully proved by merged code,
  passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator
  guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is
  being handed to another contributor as “complete”
• One qualified maintainer approval is sufficient; no last-pusher
  restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud