fix(runtime): enter safe mode instead of freezing on failed multi-block migration

[ozgb]

Overview

If any multi-block migration (MBM) fails, the current FailedMigrationHandler
(FreezeChainOnFailedMigration) leaves the migration cursor Stuck forever:
MultiBlockMigrator::ongoing() stays true, Executive admits only inherents into
blocks (a block-validity rule, so every honest node enforces it), and
frame_system::can_set_code rejects runtime upgrades. On a standalone chain like
Midnight there is no relay chain to force-replace the code, so this is a permanent,
self-reinforcing liveness failure with no on-chain recovery. Latent today (both
configured cNight MBMs are safe), but it must be fixed before the next nontrivial MBM.

Upstream's EnterSafeModeOnFailedMigration does not help — it returns KeepStuck
after entering safe mode, leaving the chain frozen (open question
paritytech/polkadot-sdk#12921), so a custom handler is required.

This PR:

• Adds pallet-safe-mode at the reserved runtime index 20. Its call filter allows
  everything while safe mode is not entered, so there is zero behavior change until
  a migration actually fails.
• Replaces the failed-migration handler with a custom
  EnterSafeModeAndUnstuckOnFailedMigration: on MBM failure it enters safe mode
  indefinitely (EnteredUntil = BlockNumber::MAX, never auto-exits) and returns
  ForceUnstuck, falling back to freezing if safe-mode entry fails (fail closed).
• Wires BaseCallFilter = InsideBoth<SafeMode, TxPause>. The safe-mode whitelist is
  the existing governance allowlist (GovernanceAuthorityCallFilter, the same set
  CheckCallFilter already enforces at the tx pool) plus the five inherents
  (a filtered Mandatory inherent = BadMandatory = no valid blocks).
  Midnight::send_mn_transaction is deliberately not whitelisted. Net effect while
  in safe mode: exact parity with today's freeze mode (inherents only) plus the
  governance recovery path — no added exposure.
• Retargets CurrencyWaiver's hold Reason from pallet_session::HoldReason to the
  composite RuntimeHoldReason (session only requires Reason: From<HoldReason>).
  Safe-mode deposits are disabled (EnterDepositAmount/ExtendDepositAmount = None),
  so the Currency is typecheck-only and permissionless entry is off; only Root
  (federated-authority motions) can force-enter/exit.

Post-failure recovery: the chain keeps producing normal blocks with user-facing calls
filtered, governance ships a fixed runtime (can_set_code is unblocked) and calls
SafeMode::force_exit.

🗹 TODO before merging

• /bot rebuild-metadata (adding a pallet changes metadata)
• Ready

📌 Submission Checklist

• All commits are signed off (git commit -s) for the DCO
• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason:
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• Updated AGENTS.md if build commands, architecture, or workflows changed
• No new todos introduced

🧪 Testing Evidence

• New regression test failed_mbm_enters_safe_mode_and_unstucks against the real
  Runtime/Executive: plants an undecodable MBM cursor, steps the MBMs via
  Executive::inherents_applied(), and asserts safe mode is entered at
  BlockNumber::MAX, the cursor is unstuck, can_set_code is unblocked, the
  BaseCallFilter blocks send_mn_transaction while passing inherents/governance/
  SafeMode::force_exit, and block 2 initializes with
  ExtrinsicInclusionMode::AllExtrinsics.

• New end-to-end test governance_can_authorize_set_code_in_safe_mode: while in
  post-failure safe mode, both collectives propose/vote/close a
  FederatedAuthority::motion_approve (exercising the collectives' internal
  Members-origin dispatch through BaseCallFilter), motion_close dispatches
  System::authorize_upgrade as Root, and force_exit lifts safe mode. Fails
  without the FederatedMotionCalls whitelist entry.

• SKIP_WASM_BUILD=1 cargo test -p midnight-node-runtime — 18 passed.

• cargo check --workspace --locked (incl. wasm build) — clean.

• cargo check -p midnight-node-runtime --features runtime-benchmarks and
  --features try-runtime — clean.

• cargo clippy --workspace — clean.

• Additional tests are provided (if possible)

🔱 Fork Strategy

• Node Runtime Update
• Node Client Update
• Other:
• N/A

New genesis field (safe_mode) defaults — no chainspec/genesis rebuild needed; live
networks pick this up via a normal set_code runtime upgrade.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c9d705a87

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 208409b0b9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".