multi: update btcd to v0.26.2

[Roasbeef]

In this PR, we update the btcd dependency from v0.26.0 to v0.26.2. The v2 submodule migration landed already in #10913, so this is a patch-level bump on top of that work: btcutil/v2 v2.0.1, wire/v2 v2.0.1, and v2transport v1.1.0 come along with the root module.

No API changes in the release, so the bump is a straight go.mod/go.sum update across the root module and the submodules that pin btcd (kvdb, healthcheck, tor, tlv, tools). The psbt + address strictness fixes on btcd master don't have tagged submodule releases yet, so they aren't part of this bump.

[github-actions]

🟡 PR Severity: MEDIUM

gh pr view | 13 files | 116 lines changed

🟡 Medium (10 files)

• go.mod - root dependency version bumps
• go.sum - root dependency lockfile update
• healthcheck/go.mod - module dependency bump (uncategorized submodule)
• healthcheck/go.sum - module dependency lockfile update
• kvdb/go.mod - kvdb submodule dependency bump
• kvdb/go.sum - kvdb submodule lockfile update
• tlv/go.mod - tlv submodule dependency bump
• tlv/go.sum - tlv submodule lockfile update
• tor/go.mod - tor submodule dependency bump
• tor/go.sum - tor submodule lockfile update

🟢 Low (3 files)

• docs/release-notes/release-notes-0.22.0.md - release notes update
• tools/go.mod - tools submodule dependency bump
• tools/go.sum - tools submodule lockfile update

Analysis

This PR is a routine dependency-bump across the repo's Go submodules (root, healthcheck, kvdb, tlv, tor, tools), plus a release notes entry. No source files in any critical or high-severity package (lnwallet, htlcswitch, contractcourt, sweep, peer, keychain, channeldb, funding, lnwire, routing, invoices, etc.) are touched, and only go.mod/go.sum/go.sum lockfiles plus a docs file changed. File count (13) and line count (116) are both well under the bump thresholds. No distinct critical packages are involved. Severity is set to MEDIUM based on the highest-tier files touched (kvdb, tlv, tor, and uncategorized root/healthcheck go.mod changes). Worth a quick check that the dependency version bumps don't pull in breaking changes, but no expert-level review is required.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}

[Lrifton92]

Did a full pass on this, verifying the bump against the btcd side rather than just the diff. LGTM.

Verified:

• Version set is internally consistent. The pinned versions match btcd v0.26.2's own go.mod exactly: btcutil/v2 v2.0.1, wire/v2 v2.0.1, v2transport v1.1.0, and the unchanged address/v2, chaincfg/v2, chainhash/v2, psbt/v2, txscript/v2 at v2.0.0. Grepped every go.mod on the PR head — no module (root, kvdb, healthcheck, tor, tlv, tools) is left pinning v0.26.0 or wire/btcutil v2.0.0.
• The golang.org/x/time v0.3.0 -> v0.15.0 bump is MVS-required, not incidental: btcd v0.26.2 adds golang.org/x/time v0.15.0 as a direct dependency (connmgr now uses rate.Sometimes for inbound-limit logging). Its propagation as // indirect into healthcheck/tor/tools/kvdb is expected.
• All new go.sum entries match sum.golang.org — checked the h1:/go.mod hashes for btcd v0.26.2, btcutil/v2 v2.0.1, wire/v2 v2.0.1, v2transport v1.1.0, and x/time v0.15.0 against the checksum DB lookups. No mismatches, no replace directives introduced.
• On the "no API changes" claim — true at the signature level, with two behavioral notes I confirmed are inert for lnd:
  1. btcutil v2.0.1 tightens NewTxFromBytes/NewBlockFromBytes (trailing bytes now rejected) and DecodeWIF (out-of-range/zero scalars rejected). lnd's only call sites of the first two are the test helpers in lnwallet/test_utils.go (fixed hex fixtures, no trailing bytes), and lnd doesn't call DecodeWIF at all.
  2. connmgr gains an additive Config.MaxInbound *uint32 field where nil preserves the historical unlimited behavior — lnd's connmgr.Config usage doesn't set it, so no behavior change. wire.ReadV2MessageN also got stricter on trailing payload bytes, but lnd never calls it directly.
• The claim that the psbt/address strictness fixes aren't included is accurate: no psbt/v2.0.1 or address/v2.0.1 tags exist on btcd, and both stay at v2.0.0 here. (Skipping v0.26.1 is also expected — only a v0.26.1-beta.rc1 tag exists, no final v0.26.1.)
• Go directives compose fine: btcd v0.26.2 requires go 1.25.0, wire/v2 v2.0.1 moved to go 1.25; lnd is at go 1.25.11.
• Release-notes entry is in the current in-progress file (release-notes-0.22.0.md) under Code Health, and CI is fully green across backends.