refactor(abstract-utxo): offline vault applies the descriptor policy spend rules

[OttoAllmendinger]

Description

Stacked on #9991 (base: its branch; retarget to master once #9987 and #9991 have merged). Two commits:

1. refactor(abstract-utxo): offline vault applies the descriptor policy spend rules (no behavior change)

#9991 made hot descriptor wallets check PoX-5 spends through DescriptorValidationPolicy.validateSpend. The offline vault still called assertPox5SpendPolicy directly in its half-sign step. Both paths now use the same entry point: the offline vault's descriptor policy is built in one function (getDescriptorPolicy) and getHalfSignedPsbt calls policy.validateSpend?.(psbt, descriptorMap). The offline vault sign step no longer names PoX-5.

2. refactor(abstract-utxo): tighten the PoX-5 early-exit policy (follow-ups from the review of #9987, #9987 (review))

• "exactly one PSBT_IN_SHA256" vs "exactly one matching record": an early exit now requires exactly one PSBT_IN_SHA256 record on the lockup input, so an extra unrelated record is refused (before, getPox5PrincipalPreimage ignored non-matching records, so two records with one matching passed). The commitment check still applies to that one record.
• classify and validate disagree: kept on purpose, now documented. classifyPox5Spend treats any PSBT_IN_SHA256 record as an early exit, so a stray record fails closed in the early-exit checks (for a late exit it hits the nLockTime 0 requirement). Classifying on "matches the descriptor commitment" would let a late exit carry an unrelated record through to signing.
• assertPox5EarlyExitSpend only checks the descriptor match: documented on the shared function, pointing at the policy that adds the nLockTime and preimage checks.
• redundant getMatchedTransactionInput and unreachable default:: removed the repeated descriptor-match check in the early-exit branch (classification has already done it), and the branch switch is exhaustive (never) instead of having an unreachable default.

The "live-tested" gate in the review stays as is: it needs the OVC beta bump, fixtures and sign-export coverage (offline-vault-console#1315), and real early-exit exports depend on SI-2002.

Issue Number

Refs: SI-1971

Type of change

• Refactor / hardening, no change for correctly built exits

How Has This Been Tested?

npx mocha --recursive test/unit/transaction test/unit/signTransaction.ts test/unit/offlineVault (450 passing). New tests: an early exit with a second, unrelated PSBT_IN_SHA256 record is rejected, and a late exit carrying a stray PSBT_IN_SHA256 record is rejected. With the validateSpend call removed from getHalfSignedPsbt, 14 of the offline vault PoX-5 tests fail. modules/utxo-descriptors unit tests still pass (53); the only change there is a doc comment.

[linear-code]

SI-1971

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run