docs(test): explain why txdb can't seed shared state across subtests

Expand the comment on TestShell_BeforeNode and TestShell_RunNode_WithBeforeNode
to document *why* heavyweight.FullTestDBV2 is the right tool here, not txdb.

The subtests need to share a seeded encrypted key ring so the
incorrect_password case has something to fail decryption against
(keystore.Unlock on an empty keystore silently creates a new ring
with whatever password is supplied). Naively you would reach for
txdb, but chainlink-common/pkg/sqlutil/pg/pg.go:69 passes
uuid.New().String() as the DSN on every pg.NewConnection call —
deliberately, so each ORM gets its own transaction — which means
the seed connection and BeforeNode's LockedDB land on different
keys in the txdb driver's DSN-keyed conns map and get independent
transactions. Seed is invisible to BeforeNode. Same reason Erik's
PR #21504 newAppWithOpts + txdb override couldn't make incorrect_password
pass.

A real per-test physical DB via FullTestDBV2 gives cross-connection
visibility with its own t.Cleanup and without polluting the shared
chainlink_test DB. No functional change — just documents the trap
so the next person doesn't repeat the investigation.

Refs: CORE-2388

Author: Fletch153

core/cmd/shell_local_test.go

@@ -509,15 +509,31 @@ func TestShell_RemoveBlocks(t *testing.T) {
 func TestShell_BeforeNode(t *testing.T) {
 	testutils.SkipShortDB(t)
 
-	// Use a real isolated DB (dropped on t.Cleanup via heavyweight.FullTestDBV2)
-	// so both subtests share persisted keystore state. This is required because:
-	//   1. keystore.Unlock on an *empty* keystore silently creates a fresh key
-	//      ring encrypted with whatever password you pass — so any password
-	//      "works" against an empty DB, including the wrong one.
-	//   2. The incorrect_password subtest can only meaningfully fail if there
-	//      is an existing encrypted key ring to fail decryption against.
-	// txdb isolation would roll back the seed between subtests, so we use a
-	// persistent per-test DB instead.
+	// Use heavyweight.FullTestDBV2 (real isolated per-test Postgres DB,
+	// dropped on t.Cleanup) because both subtests must share a persisted
+	// encrypted key ring:
+	//
+	//   1. keystore.Unlock on an *empty* keystore silently creates a fresh
+	//      key ring encrypted with whatever password you pass — so any
+	//      password "works" against an empty DB, including the wrong one.
+	//      The incorrect_password subtest can only fail meaningfully if
+	//      there is an existing ring to fail decryption against.
+	//
+	//   2. txdb isolation can't be used here: chainlink-common's
+	//      pg.NewConnection deliberately passes uuid.New().String() as the
+	//      DSN to the txdb driver on every call (see
+	//      chainlink-common/pkg/sqlutil/pg/pg.go:69 — "Each ORM should be
+	//      encapsulated in its own transaction"). That means the seed
+	//      connection and BeforeNode's LockedDB land on different keys in
+	//      the txdb driver's DSN-keyed conns map and get independent
+	//      transactions, so the seed would be invisible to BeforeNode.
+	//      This convention is also why Erik's PR #21504, which tried to
+	//      force txdb via a newAppWithOpts override, couldn't make the
+	//      incorrect_password case work.
+	//
+	// A real per-test physical DB gives us the cross-connection visibility
+	// the test needs, with its own cleanup and without polluting the
+	// shared chainlink_test DB used by every other test.
 	cfg, sqlxDB := heavyweight.FullTestDBV2(t, func(c *chainlink.Config, s *chainlink.Secrets) {
 		s.Password.Keystore = models.NewSecret("dummy-to-pass-validation")
 		c.EVM[0].Nodes[0].Name = ptr("fake")
@@ -595,10 +611,10 @@ func TestShell_BeforeNode(t *testing.T) {
 func TestShell_RunNode_WithBeforeNode(t *testing.T) {
 	testutils.SkipShortDB(t)
 
-	// See TestShell_BeforeNode for why we need a real shared DB with a seeded
-	// key ring: keystore.Unlock on an empty keystore silently creates keys
-	// with whatever password is passed, so an empty DB can't meaningfully
-	// test the incorrect_password case.
+	// See TestShell_BeforeNode for the full rationale (TL;DR: txdb can't
+	// be used to seed shared state because pg.NewConnection generates a
+	// fresh UUID DSN per call, isolating every pool into its own
+	// transaction — so we need a real per-test physical DB instead).
 	cfg, sqlxDB := heavyweight.FullTestDBV2(t, func(c *chainlink.Config, s *chainlink.Secrets) {
 		s.Password.Keystore = models.NewSecret("dummy-to-pass-validation")
 		c.EVM[0].Nodes[0].Name = ptr("fake")