ci: fix three external e2e regressions

[lwshang]

Description

Three upstream regressions broke e2e. All three landed after master's last e2e run on
2026-06-23, which is why master appears green. Split out of #4545 so each has its own
bisect point.

fix: pin vite-plugin-environment to 1.1.3 — 1.1.4, published 2026-09-09, raises its peer
dependency from vite >= 2.7 to vite >= 8.0. The frontend templates ask for ^1.1.3 against
vite ^4.3.9 (^5.4.3 for svelte), so npm install in a newly created project fails with
ERESOLVE, node_modules stays empty, and the build then fails with tsc: command not found.
This broke every job that deploys a frontend project: smoke, ui_test, dfx/new, dfx/info,
dfx/telemetry, dfx/playground, dfx/frontend, dfx/deploy, and one dfx/assetscanister
case.

ci: download bitcoin core from bitcoincore.org — bitcoin.org no longer serves the
bitcoin-core binaries and returns 404, failing the dfx/bitcoin jobs during provisioning.
bitcoincore.org serves the same release; the existing sha256 check on the tarball is unchanged
and still verifies what is downloaded.

ci: pin ic-mops to 2.24.0 in the playground e2e test — ic-mops 3.0.0, published
2026-08-20, removed the toolchain init and toolchain reset subcommands. setup_playground
calls mops toolchain init, so an unpinned npm i -g ic-mops installs 3.x and all six
playground tests fail in setup with unknown command 'init'.

How Has This Been Tested?

• npm registry metadata confirms both publish dates and the peer-dependency change.
• Locally: all four frontend templates resolve with the pin, and vanilla_js fails without it
  (control).
• npx ic-mops@2.24.0 toolchain --help lists init; @3.2.3 does not.
• curl -I returns 404 from bitcoin.org and 200 from bitcoincore.org for the same tarball.
• These three commits took feat!: length-prefix every variable-length field in asset canister evidence #4545 from 16 e2e failures to 0.

Checklist:

• The title of this PR complies with Conventional Commits.
• I have edited the CHANGELOG accordingly.
• I have made corresponding changes to the documentation.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 6322594.

Security Overview

• 🔎 Scanned files: 7 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/54bfa532-d98c-41d3-a572-866d55d9f461?scanId=1fe79201-35b3-4602-958d-22d1dbd886b6&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Bug Fix	► CHANGELOG.md     ### fix: dfx new projects install again     vite-plugin-environment 1.1.4 raised its peer dependency to vite >= 8.0, which no longer     resolves against the vite version the frontend templates use, so npm install failed in a     newly created project. The templates now ask for exactly 1.1.3.
Other	► e2e/tests-dfx/playground.bash     - Pinned: ic-mops 3.0.0 removed mops toolchain init, which setup_playground uses.
Other	► scripts/workflows/provision-linux.sh     - Updated URL for Bitcoin Core tarball download from bitcoin.org to bitcoincore.org
Enhancement	► src/dfx/assets/project_templates/react/src/frontend_name/package.json     - Change: vite-plugin-environment version from ^1.1.3 to 1.1.3
Enhancement	► src/dfx/assets/project_templates/svelte/src/frontend_name/package.json     - Change: vite-plugin-environment version from ^1.1.3 to 1.1.3
Enhancement	► src/dfx/assets/project_templates/vanilla_js/src/frontend_name/package.json     - Change: vite-plugin-environment version from ^1.1.3, to 1.1.3
Enhancement	► src/dfx/assets/project_templates/vue/src/frontend_name/package.json     - Change: vite-plugin-environment version from ^1.1.3 to 1.1.3