fix(ci): resolve pre-existing CI debt — config_manager buildinfo tests + merchant in go-test matrix

[felixfelix-bot]

Summary

Fixes pre-existing CI debt on main (SEC-AUDIT T10):

1. go-test (src/config_manager) was failing — buildinfo_test.go expectations were stale after fix: stop injecting test mint in release builds #359 added five more production mints (lnserver.com, macadamia.cash, westernbtc.com, kashu.me, cubabitcoin.org) and made IsDevBuild() treat unknown/empty branches as non-dev. Tests now assert 7 production mints on main/unknown/empty and 8 (7 + testnut) on feature branches, matching the merged behavior.

2. src/merchant was excluded from the go-test matrix — it now builds and tests standalone (its go.mod gained the ltcsuite/ltcd exclude directive and a full re-tidy in fix(deps): drop felixfelix-bot fork replace — build against OpenTollGate gonuts-tollgate v0.11.1 #361), so it is added to the matrix. src/cli, src/upstream_detector and src/upstream_session_manager remain omitted pending the same rewrite.

3. deps-and-imports job — verified passing locally (check-deps-sync.py and check-import-paths.py both exit 0). The stale merchant go.mod (pinning gonuts v0.10.0) was already resolved on main by fix(deps): drop felixfelix-bot fork replace — build against OpenTollGate gonuts-tollgate v0.11.1 #361 (now v0.11.1).

Verification (all green)

• go build ./... — exit 0
• go vet ./... — exit 0
• go test -race -count=1 -tags testenv . (main pkg) — ok, 16.1s
• go test -race -count=1 ./... (config_manager) — ok, 1.27s
• go test ./... (merchant) — ok, 197.9s
• go test ./... (utils, tollgate-cli, lightning, tollgate_protocol, tollwallet, valve, wireless_gateway_manager) — all ok
• node tests/contract/js-schema-lint.mjs — PASS
• bash tests/contract/build-purity.sh — 3 passed, 0 failed
• python3 tests/contract/check-deps-sync.py — ✅ 124 deps in sync
• python3 tests/contract/check-import-paths.py — ✅ 117 files correct

Docs

• docs/cashu-compatibility-matrix.md updated to list all 7 production mints (same commit as the test sync).
• CHANGELOG.md entries added under [Unreleased] → Changed / Internal.

Out of scope

W-3 (reseller auto-spend to self-signed fake upstream, Amperstrand #72) is a separate security change (signature verification + key allowlisting in upstream_session_manager/session.go) and will be addressed in its own focused PR.

[felixfelix-bot]

Cold review (Gate 2.5)

Cross-family reviewer verdict (cold, no prior context):

{
  "verdict": "approve",
  "blocking_issues": [],
  "non_blocking_notes": [
    "The 'main' branch subtest in TestNewDefaultConfig_MintsForBranch only asserts the count (7) and testnut absence; it does not verify the specific 7 production mint URLs. Consider asserting the full expected set to guard against a wrong-but-7-mint config.",
    "The docs/cashu-compatibility-matrix.md change asserts the 5 newly added mints use V1 keysets; this factual claim is not verifiable from the diff alone and relies on the author's prior verification.",
    "No empty-branch subtest appears in TestNewDefaultConfig_MintsForBranch (only in TestIsDevBuild_DefaultBranch). If a stale empty-branch subtest with the old 3-mint expectation exists, it would fail — worth confirming CI passes.",
    "TestDefaultProductionMints only checks mints[0].URL (coinos.io); the remaining 6 mint URLs are unverified by the test."
  ],
  "summary": "This PR cleanly resolves pre-existing CI debt with three tightly-scoped, mutually consistent changes. The buildinfo_test.go expectations are correctly synced to the post-#359 behavior: unknown/empty branches are now non-dev, main/unknown/empty yield 7 production mints, feature branches yield 8 (7 + testnut), and the unknown-branch subtest now explicitly asserts testnut is absent. The CI matrix change adds src/merchant with a clear rationale and correctly trims the omission comment. The docs and CHANGELOG are consistent with the code changes. No scope creep and no blocking issues."
}

All non-blocking notes are minor test-strengthening opportunities; none block merge.