release: Bump Pendulum spec version to 26

[ebma]

Release PR for the Pendulum runtime that ships the token-migration pallet (#559).

What changes

• spec_version 25 → 26. transaction_version stays at 11: the upgrade adds a pallet at a new index (102) and a BaseFilter arm — no existing call index, argument or signed extension changes, so transactions signed against spec 25 remain valid across enactment.
• Reproducible release build on GitHub Actions. The GitLab pipeline this repo's release.yml used to trigger no longer exists (runners decommissioned). The workflow now builds the runtime with srtool (image 1.81.0, matching rust-toolchain.toml) on a GitHub-hosted runner, records the srtool/subwasm report, and attaches the compressed wasm plus the report to the GitHub release for a pushed <chain>-release-<spec> tag. A manual run without a tag is a dry run that keeps the artifacts on the workflow run only.

Validation already done (local build of this exact tree, spec 26)

• Phase 2 on a fresh Chopsticks fork of live mainnet with the wasm as override: 14/14 — the fork reports spec 26; the pallet ships paused with no storage written; MigrationInitiated field order intact; real locked balances refused; treasury account present; nonces monotonic.
• RB-5 drill on a pristine spec-25 fork: 5/5 — the wasm written to :code under a running four-attestor fleet; every attestor decoded post-upgrade blocks without a restart and rode a node restart.
• Local artifact (not the one to ship): pendulum_runtime.compact.compressed.wasm, 2,206,797 bytes, sha256 8e82e2e8f0e17eb2174aa114cef2b999e52b905bb6e87b51a0aae8e72100c782.
• Dry run of the new workflow: https://github.com/pendulum-chain/pendulum/actions/runs/34232584726 (in progress at the time of opening; result to be posted here).

Decisions recorded in docs/pen-migration-internal-review.md: minimum migration amount stays 100 PEN, pause origin unchanged, no BaseFilter mint block, dev-machine benchmark weights accepted as production weights.

After merge

1. Tag the merge commit pendulum-release-26 and push the tag — the workflow builds and publishes the release automatically.
2. Compare the published srtool hash with an independent rebuild (same commit, same srtool image).
3. Re-run phase 2 and the RB-5 drill against the published wasm (the thing tested must be the thing shipped).
4. Referendum with the published hash in its text. The pallet arrives paused; unpausing is a separate governance act after the Base side is live.

[ebma]

Dry run of the srtool workflow: success — https://github.com/pendulum-chain/pendulum/actions/runs/34232584726

Built from 746cbd5 (the workflow commit, before the bump was cherry-picked, hence spec 25 — the point was to prove the pipeline, not the artifact):

• srtool v0.17.0, rustc 1.81.0 (matches rust-toolchain.toml)
• compressed runtime 2,177,188 bytes, sha256 8744640e…3bca7 (verified against the downloaded artifact)
• subwasm report parsed: blake2_256, democracy proposal_hash and parachain_authorize_upgrade_hash all present

The publish step was skipped as designed (no tag). After merge: push pendulum-release-26 on the merge commit and the same job publishes the spec-26 artifact to the release.