feat: enable log memory store feature

fix: Fix python bazel wrapper after upgrade (#10479)

After #10413 upgraded `rules_python`,
nightly bare metal jobs started failing. This updates how we bazel wrap
our tools, to match the new environment format.

Revert "chore(Core): Limit wasm locals (#10430)"

This reverts commit 060292f.

chore(systests): force testnet allocation to the local DC for all sys…

…tem-tests (#10436)

# What

Force Farm testnet allocation to the same DC as the GitHub runner
executing the test (which is also the DC holding the just-built images)
— for **every** system-test. This generalizes the opt-in
`.allocate_testnet_to_local_dc()` mechanism introduced in #10122.

# Why

#10122 showed that cross-DC transfers of large images (e.g. 2.6G SetupOS
images from `dm1` to `zh1` or vice versa) cause download timeouts and
flaky tests. The same applies to all system-tests, so testnets should
always be allocated in the DC where the test runs and the images live.

# How

* Replace the `allocate_testnet_to_local_dc` bool on `SystemTestGroup`
(and its builder method) with the `ALLOCATE_TESTNET_TO_LOCAL_DC`
environment variable, read by the test driver in `create_group_setup`
(accepted values: `1`/`true`/`0`/`false`).
* Set `ALLOCATE_TESTNET_TO_LOCAL_DC=1` unconditionally from the
`system_test` macro in `rs/tests/system_tests.bzl`, covering both the
plain and the `_colocate` targets. This remains a no-op when the `DC`
volatile status variable is unknown (e.g. local runs without
`NODE_NAME`).
* Drop the now-redundant `.allocate_testnet_to_local_dc()` calls from
the 7 nested system-tests.
* Replace `dep_download_url` in `rs/tests/upload_systest_dep.sh` to no
longer go via the dc_http_proxy but point directly at the DC-local bazel
cache: `https://artifacts.$cluster.dfinity.network/cas/$dep_sha256`.
* Force the `release-system-tests` job in `release-testing.yml` and the
`system-tests-benchmarks-nightly` job to run in runner group `dm1` (the
`&dind-large-setup` anchor moved to `setup-guest-os-qualification`,
whose jobs keep their current runners).

# Notes for reviewers

* Pinning all tests to the runner's DC concentrates Farm load in `dm1`
where most runners live; watch for allocation failures after rollout.
Extra charts have been added to the [Farm
Dashboard](https://grafana.dm1-idx1.dfinity.network/d/uwEFG_yGk/farm-dashboard?from=now-3h&to=now&timezone=utc&refresh=10s)
for monitoring dm1 and zh1.
* Farm hosts/UVMs now fetch deps from
`artifacts.<cluster>.dfinity.network` over HTTPS (previously plain http
via proxy-global:8080); the redirect server already returns URLs of this
form.

test: make `FakeStateManager` return a valid height witness (#10364)

This PR makes `FakeStateManager` return a valid height witness in its
implementation of `list_state_hashes_to_certify`. This change is driven
by an upcoming new consensus integration test which depends on the
certified height increasing. Though as of today, nodes in the
integration test keeps
[invalidating](https://github.com/dfinity/ic/blob/8dc9fa9ad19c79f9d20d757fe95c306fc66389be/rs/consensus/certification/src/certifier.rs#L604)
certification shares (preventing the certified height to increase)
because the height witness is not valid.

To do so, the `FakeStateManager` now calls the [same
functions](https://github.com/dfinity/ic/blob/8dc9fa9ad19c79f9d20d757fe95c306fc66389be/rs/state_manager/src/lib.rs#L1914-L1927)
as `StateManagerImpl` (i.e. `replicated_state_as_lazy_tree`,
`hash_lazy_tree`, `compute_state_height_witness`) to compute the witness
instead of using a `::new_for_testing`.
The common part of the code was thus moved to the `ic_canonical_state`
crate.

fix: Also reduce read_ahead for dm-* devices (#10420)

Looks like it was actually dm-2 (store-crypt) and/or dm-4
(store-shared--data, more likely) suffering from read amplification, not
vda. They're probably all the same (virtual?) device underneath, which
is why reads appear to be spiking on all 3 at once. But it's likely the
shared data partition that is actually being pounded.

Reduce the read-ahead for all these devices similar to what was done for
vda, just to be safe.

feat: enable canister log memory store feature [DO NOT MERGE]

chore: Update Base Image Refs [2026-06-03-1831] (#10381)

Updating base container image references.

Run URL: https://github.com/dfinity/ic/actions/runs/26904782940

---------

Co-authored-by: Bownairo <7826872+Bownairo@users.noreply.github.com>
Co-authored-by: Eero Kelly <eero.kelly@dfinity.org>

feat: enable canister log memory store feature [DO NOT MERGE]

chore: Update Base Image Refs [2026-05-28-0908] (#10333)

Updating base container image references.

Run URL: https://github.com/dfinity/ic/actions/runs/26565442722

Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com>