[r3.5] release: Erigon v3.5.5

[lystopad]

Prepares the Erigon v3.5.5 — Tidal Tails release on release/3.5.

Mirrors the v3.5.4 release commit (#22813):

• db/version/app.go: bump Micro 4 -> 5 (3.5.4 -> 3.5.5).
• ChangeLog.md: add the v3.5.5 release notes section.

Included since v3.5.4

Bugfixes

• cl/beacon: handle empty Fulu builder response ([r3.5] cl/beacon: handle empty Fulu builder response #23150, fixes cl/beacon: Fulu blinded block submission panics on nil execution payload #22598)
• execution: build payloads until the slot they are for ([r3.5] execution: build payloads until the slot they are for #23102)
• db/state: route receipt domain reads through overlay DomainReader
  ([r3.5] db/state: CP route receipt domain reads through overlay DomainReader #22951, fixes eth_getLogs returns inconsistent log indexes #22106)
• db/state: roll back receipt domains on in-RAM reorg unwind ([r3.5] fix(state): roll back receipt domains on in-RAM reorg unwind #23064)
• db/downloader: allow seeding caplin state snapshots with nil global type
  ([r3.5] db/downloader: allow seeding caplin state snapshots (nil global type) #22980)

Security

• build: bump x/text, x/net, webtransport-go and chi for CVE-2026-56852,
  CVE-2026-46600, CVE-2026-57497, CVE-2025-69725 and three chi RealIP
  advisories ([r3.5] build(deps): bump x/text, x/net, webtransport-go, chi for security advisories #23178)

Improvements

• build: revert the go-eth-kzg verifier optimization ([r3.5] go.mod: revert go-eth-kzg verifier optimization #23177)

Three items are called out in the release-notes intro: the Fulu builder panic
(#23150) breaks every blinded-block submission for validators proposing through
an external builder, #23102 could hand an external consensus layer a payload
frozen before its slot began, and #22951 served wrong logIndex values to
eth_getLogs and eth_getTransactionReceipt on v3.5.1-v3.5.4.

Notes-format deviation

This section adds a Security subsection, which earlier 3.5.x notes do not
use — v3.5.4 filed its grpc bump under Improvements. The CVE-driven bumps
are worth a heading operators and downstream packagers can grep for. Collapse it
into Improvements if the established shape is preferred.

Not listed in the release notes

Docs-only, per the established convention of omitting docs commits:

• docs: August 2026 w33 — CLI reference gaps on release/3.5, dead checkpoint endpoint #23180 (docs: August 2026 w33 — CLI reference gaps on release/3.5, dead checkpoint endpoint)
• docs: network tabs, ext4/XFS guidance, and README-only content moved to the site #22919 (docs: network tabs, ext4/XFS guidance, and README-only content moved to the site)
• docs(site): Quantify brand wordmark + minimal theme-aware footer #23070 (docs(site): Quantify brand wordmark + minimal theme-aware footer)
• docs(site): stop the external-CL steps handing out 0.0.0.0 #23086 (docs(site): stop the external-CL steps handing out 0.0.0.0)
• docs: fix the easy-node external-CL and Caplin instructions #23023 (docs: fix the easy-node external-CL and Caplin instructions)

Full changelog:
v3.5.4...v3.5.5

Follow-up

After this release, port the v3.5.5 notes to main (mirroring #22831) and to
release/3.6 (mirroring #22832). Neither branch's db/version/app.go is
touched — they are on the 3.7.0 and 3.6.0 lines respectively.