[samgbafa]

Summary

• Bump tinycloud-node to 1.25.20 from current main at 7ddd53decbe1e26e3cd99cd54cb7cdabad78315f.
• Add the Monica-approved 1.25.20 changelog section with only the TC-2518 and TC-2712 entries; no older Unreleased entries are carried into this release section.
• Refresh the two Cargo lockfiles so their recorded tinycloud-node package version matches 1.25.20. No dependency versions change.

The release source is main: it contains the merged #534 and #540 changes and the #539 threshold crate, which remains unwired from the production node. Draft #541 is excluded and remains rotation-only.

Validation

• cargo metadata --locked --offline --format-version 1 succeeds at the workspace root and test/m1-realdata-e2e.
• git diff --check passes.
• CI is expected to validate this version-only change at the PR head.

Release gate

This PR is preparation only. No merge, tag, release publication, or production promotion is authorized here. Production promotion remains gated on Clarissa's OpenKey signed-in check, Naomi's explicit GO, one production change at a time, and a fresh provider-native backup immediately before promotion after verifying the actual live DB identity tinycloud-node-production-usw. TCW2 writes and key_wrap_require_v2 remain disabled by default. Binary rollback to 1.25.19 is safe only for v1 traffic while both settings remain off; any v2-emitting client must be repinned to v1 first or may have requests refused by 1.25.19. If v2 writes or require-v2 are enabled, fix forward; no DB restore without separate GO.