tac: add TAC mainnet archive profile with EVM JSON-RPC upstream

- Add archive profile (pruning=nothing) for tacchaind
- Change client_rpc_port from 26657 (CometBFT) to 8545 (EVM JSON-RPC)
- Update Dockerfile to download pre-built binary from GitHub releases v1.6.0
- Verify binary against checksums.txt
- Update init.sh to support PRUNING env var (nothing for archive, default for pruned)
- Update peers from NETWORKS.md
- Add archive snapshot URL note
- Traefik routes to EVM JSON-RPC port 8545 for both pruned and archive

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

tac/tacchaind.Dockerfile

@@ -1,38 +1,42 @@
-# tacchaind — source build mirroring upstream TacBuild/tacchain Dockerfile (v1.6.0).
+# tacchaind — binary download from GitHub releases (v1.6.0).
+# Downloads pre-built linux-amd64 binary and verifies against checksums.txt.
 ARG VERSION=v1.6.0
 
-FROM golang:1.23.8-alpine3.21 AS go-builder
-
-ARG VERSION
-
-RUN apk add --no-cache \
-    ca-certificates \
-    build-base \
-    git \
-    libusb-dev \
-    linux-headers \
-    eudev-dev
-
-WORKDIR /code
-RUN git clone https://github.com/TacBuild/tacchain.git /code && \
-    cd /code && \
-    git checkout "${VERSION}" && \
-    LEDGER_ENABLED=true make build
-
 FROM alpine:3.21
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache \
     ca-certificates \
+    curl \
     libusb
 
-COPY --from=go-builder /code/build/tacchaind /usr/bin/tacchaind
+# Download binary and checksums
+ARG VERSION
+RUN set -eux; \
+    BINARY_URL="https://github.com/TacBuild/tacchain/releases/download/${VERSION}/tacchaind-linux-amd64" && \
+    CHECKSUMS_URL="https://github.com/TacBuild/tacchain/releases/download/${VERSION}/checksums.txt" && \
+    curl -sL -o /tmp/tacchaind "${BINARY_URL}" && \
+    curl -sL -o /tmp/checksums.txt "${CHECKSUMS_URL}" && \
+    # Verify the binary against checksums.txt (sha256sum format: <hash>  <filename>)
+    cd /tmp && \
+    ExpectedHash=$(grep "tacchaind-linux-amd64$" checksums.txt | awk '{print $1}') && \
+    ActualHash=$(sha256sum tacchaind | awk '{print $1}') && \
+    if [ "$ExpectedHash" != "$ActualHash" ]; then \
+      echo "ERROR: checksum mismatch for tacchaind-linux-amd64" >&2; \
+      echo "  Expected: $ExpectedHash" >&2; \
+      echo "  Actual:   $ActualHash" >&2; \
+      exit 1; \
+    fi && \
+    chmod +x /tmp/tacchaind && \
+    mv /tmp/tacchaind /usr/bin/tacchaind && \
+    rm -f /tmp/checksums.txt
+
 COPY ./scripts/cometbft-common.sh /usr/local/bin/cometbft-common.sh
 COPY ./scripts/init.sh /usr/local/bin/init.sh
 RUN chmod +x /usr/local/bin/init.sh /usr/local/bin/cometbft-common.sh
 
 WORKDIR /opt
 
-EXPOSE 1317 26656 26657
+EXPOSE 1317 26656 26657 8545 8546
 
 ENTRYPOINT ["init.sh"]