test: pin the external fixtures and run the suites against the silo binary

The test and verification scripts invoked ./minio and pulled their tooling from
upstream infrastructure with no integrity check. Every `curl | tar` of a client
or an old server binary was an unverified execution path in a script that
regularly runs as a privileged user, and several fetched a floating "latest".

Two installers replace all of it:

- install-mcli.sh resolves a pinned pgsty/mc release, downloads the archive and
  its checksum manifest, requires exactly one valid manifest entry for the
  asset, verifies it, and installs. MCLI_BIN with a mandatory MCLI_SHA256 lets
  an offline or air-gapped run supply its own binary, still checksum-checked.
- install-verified-fixture.sh takes source, expected SHA-256 and target, and
  refuses anything that does not match. Sources may be a URL or a local file.

Every script that previously downloaded mc now calls install-mcli.sh. The three
places that genuinely need an upstream artifact - the old MinIO server binary
for the LDAP IAM upgrade-import test, the 2021 mc for the three-site
replication test, and the functional-tests.sh fixture - go through
install-verified-fixture.sh with the digest recorded inline. Those dl.min.io
URLs remain on purpose: they are historical upstream artifacts needed to prove
upgrade compatibility, and they are now pinned and verified rather than
trusted.

The scripts otherwise switch to ./silo, silo.service, the silo container and
compose service names, and SILO_CONFIG_DIR. run-multi-site-minio-idp.sh is
renamed to run-multi-site-silo-idp.sh with the Makefile target following.
buildscripts/minio-upgrade.sh keeps its name and its `minio server` argv - it
exists to test the MinIO-to-Silo upgrade, so the old side must stay old - but
it is now pinned to an image digest rather than a tag, and its `docker system
prune` and `docker volume prune` calls are removed. Those ran unfiltered
against the developer's whole Docker installation; the resiliency tests had the
same problem and lose their prune and `docker ps -q` sweeps too.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/resiliency/docker-compose.yaml

@@ -1,9 +1,9 @@
 # Settings and configurations that are common for all containers
-x-minio-common: &minio-common
+x-silo-common: &silo-common
   build:
     context: ../../.
-    dockerfile: Dockerfile
-  command: server --console-address ":9001" http://minio{1...4}/data{1...8}
+    dockerfile: Dockerfile.goreleaser
+  command: server --console-address ":9001" http://silo{1...4}/data{1...8}
   expose:
     - "9000"
     - "9001"
@@ -15,13 +15,13 @@ x-minio-common: &minio-common
     timeout: 5s
     retries: 5
 
-# starts 4 docker containers running minio server instances.
+# Starts four containers running Silo server instances.
 # using nginx reverse proxy, load balancing, you can access
 # it through port 9000.
 services:
-  minio1:
-    <<: *minio-common
-    hostname: minio1
+  silo1:
+    <<: *silo-common
+    hostname: silo1
     volumes:
       - data1-1:/data1
       - data1-2:/data2
@@ -32,9 +32,9 @@ services:
       - data1-7:/data7
       - data1-8:/data8
 
-  minio2:
-    <<: *minio-common
-    hostname: minio2
+  silo2:
+    <<: *silo-common
+    hostname: silo2
     volumes:
       - data2-1:/data1
       - data2-2:/data2
@@ -45,9 +45,9 @@ services:
       - data2-7:/data7
       - data2-8:/data8
 
-  minio3:
-    <<: *minio-common
-    hostname: minio3
+  silo3:
+    <<: *silo-common
+    hostname: silo3
     volumes:
       - data3-1:/data1
       - data3-2:/data2
@@ -58,9 +58,9 @@ services:
       - data3-7:/data7
       - data3-8:/data8
 
-  minio4:
-    <<: *minio-common
-    hostname: minio4
+  silo4:
+    <<: *silo-common
+    hostname: silo4
     volumes:
       - data4-1:/data1
       - data4-2:/data2
@@ -80,10 +80,10 @@ services:
       - "9000:9000"
       - "9001:9001"
     depends_on:
-      - minio1
-      - minio2
-      - minio3
-      - minio4
+      - silo1
+      - silo2
+      - silo3
+      - silo4
 
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.