#34213 net: preserve anchors when network is disabled

• Prevent anchor peers from being erased when a node shuts down with networking disabled
• Maintain eclipse attack resilience across restarts after running offline

This PR prevents `anchors.dat` from being overwritten with an empty file when a node is cleanly stopped while network activity is disabled (such as via `-networkactive=0` or the `setnetworkactive false` RPC). It introduces a mutex to guard `m_anchors`, saves active block-relay-only connections into `m_anchors` upon network deactivation, halts consuming anchors while networking is disabled in `ThreadOpenConnections()`, and dumps those stored anchors on shutdown.

Problem: When a node shuts down with networking disabled, `GetCurrentBlockRelayOnlyConns()` returns an empty list since no connections are active. Bitcoin Core previously overwrote `anchors.dat` with this empty list, causing the node to lose its previous block-relay-only peers and degrading eclipse attack resilience on the following restart.

P3 · bug fix

• P3 because it fixes a corner-case bug where anchors protecting against eclipse attacks are dropped offline
• Losing anchors degrades restart topology diversity but is not easily exploitable in standard operation

P3 because it addresses a corner-case bug where anchors protecting against eclipse attacks are dropped when stopping an offline node. While losing anchors degrades restart topology diversity, it is not an easily exploitable vulnerability under standard node operation.

Membership: Modifies CConnman peer connection management, anchor persistence logic, and block-relay-only connection tracking in src/net.cpp.

Factors: security/stability 1, bug 1, performance 0, user value 1, leverage 0

• Ready for review
• All thread-safety and edge-case concerns have been addressed

The code is clean, CI passes, and all reviewer feedback regarding thread-safety and edge cases has been addressed and tested.

Author status: active

Resolved concerns:

• Thread safety: danielabrozzoni identified a race between `SetNetworkActive` flipping `fNetworkActive` and socket handlers clearing nodes before anchors could be read, resolved by capturing anchors before toggling the flag and adding mutex locking.
• Anchor consumption while offline: willcl-ark pointed out that `ThreadOpenConnections()` still popped and dropped anchors when networking was disabled, resolved by gating anchor selection on active networking.
• Anchor count ordering: w0xlt noted that peers should be capped to the oldest block-relay connections matching startup behavior, which the author adopted.

• Broad agreement on preserving anchors across offline restarts
• Strong support because it improves restart eclipse resilience without dropping anchors (willcl-ark)
• Concept approval with review of anchor life cycle and lock ordering (danielabrozzoni)
• Concept approval confirming benefits for nodes started offline (waketraindev)

Strong consensus with an explicit ACK from willcl-ark and earlier Concept ACKs from danielabrozzoni and waketraindev.

Reviewers agreed with the concept of preserving anchors across offline restarts to avoid degrading eclipse protection. Technical concerns regarding data races and anchor popping were addressed to reviewers' satisfaction.

• willcl-ark approved: 'Disabling networking should not cause the node to lose its anchors. Preserving them across a clean shutdown lets the node reconnect when networking resumes, increasing eclipse attack resilience on restarts.'
• danielabrozzoni provided Concept ACK and detailed review of the anchor life cycle and lock ordering.
• waketraindev noted 'Concept ACK' and verified that nodes started with network inactive benefit from this change.

Review verdicts (DrahtBot): 1 (+2)

• ACK: willcl-ark
• Stale ACK: bensig, Bortlesboat
• Concept ACK: waketraindev, danielabrozzoni

File list not available for this run.

This pull request ensures that block-relay-only anchor connections are preserved in anchors.dat when bitcoind is shut down while network activity is disabled. Previously, shutting down an offline node overwrote anchors.dat with zero entries, stripping eclipse attack protections for subsequent boots. The PR captures block-relay connections on deactivation, guards anchor storage with a mutex, and stops consuming anchors while offline. Code review is positive with an explicit ACK from willcl-ark following resolved race condition and connection handling discussions.