Tests: Regression test for multisig change detection and consolidation handling

[nkatha23]

In response to issue #931 , this is what I found:

Reading through PSBTParser._parse_outputs(), I noticed two spending scenarios that weren't covered by the existing test suite:

1. Multisig PSBT with no witness script in the output scope. Some coordinators produce PSBTs where the output scopes contain only the bare scriptPubKey, no witness_script, no redeem_script. The parser can't reconstruct the multisig
   policy from a bare script hash, so it has no way to verify that the output belongs to the wallet. The safe, correct behaviour is to treat it as an external spend. That path existed in the code but was never exercised by a test, meaning a future refactor could silently break it.
2. Consolidation where every output is internal. A PSBT that sends everything backto the same wallet, split across a change-branch address (1/) and a receive-branch address (0/) should produce spend_amount == 0. The parser
   classifies any output as internal when the derived key matches the output scriptPubKey, regardless of branch index. Again, this worked but wasn't tested.

so this PR adds:
Two new test methods inside TestPSBTParser in tests/test_psbt_parser.py:
test_multisig_no_descriptor_all_outputs_are_spend- covers all three multisig script types. Strips witness_script and redeem_script from the output scope and pins that num_change_outputs == 0 with everything treated as spend.
test_consolidation_all_outputs_internal- covers all seven supported script types. Two internal outputs (change-branch + receive-branch) both belonging to the signing wallet, pins spend_amount == 0 and change_amount == input_amount - fee.

[kdmukai]

1. Multisig PSBT with no witness script in the output scope. Some coordinators produce PSBTs where the output scopes contain only the bare scriptPubKey, no witness_script, no redeem_script.

Can you provide info about the specific coordinator(s) and specific conditions that would create this type of PSBT?

[kdmukai]

2. Consolidation where every output is internal. A PSBT that sends everything backto the same wallet, split across a change-branch address (1/) and a receive-branch address (0/) should produce spend_amount == 0. The parser
classifies any output as internal when the derived key matches the output scriptPubKey, regardless of branch index. Again, this worked but wasn't tested.

We already have multisig psbts with self-receive + change as the only outputs. It would be cleaner to just add a few extra checks once those psbts are created:

https://github.com/nkatha23/seedsigner/blob/0e71f300dd1abd587ab74636a3532f3870275a72/tests/test_psbt_parser.py#L268-L283

assert psbt_parser.num_destinations == 0
assert psbt_parser.num_change_outputs == 2
assert psbt_parser.spend_amount == 0
# etc...

[kdmukai]

2. Consolidation where every output is internal. A PSBT that sends everything backto the same wallet, split across a change-branch address (1/) and a receive-branch address (0/) should produce spend_amount == 0. The parser
classifies any output as internal when the derived key matches the output scriptPubKey, regardless of branch index.

For single sig, we have a close-enough existing test harness that just needs to be extended to cover this scenario. See run_basic_test.

[kdmukai]

As of 0e71f30:

NACK on test_consolidation_all_outputs_internal as existing tests nearly cover it and just need light enhancements to provide the same scenario coverage with less additional harnessing.

No opinion yet on test_multisig_no_descriptor_all_outputs_are_spend until we get more clarification on seeing this in real-world usage.

[nkatha23]

No opinion yet on test_multisig_no_descriptor_all_outputs_are_spend until we get more clarification on seeing this in real-world usage.

No documented coordinator has been shown to produce a multisig PSBT where the change output is missing witness_script. I looked and couldn't find one. The test isn't grounded in a reported user problem, it's a defensive pin of a security property: the parser must never classify an output as change without cryptographic verification of ownership. The risk being guarded against is a future internal refactor, not a current coordinator.

[nkatha23]

1. Multisig PSBT with no witness script in the output scope. Some coordinators produce PSBTs where the output scopes contain only the bare scriptPubKey, no witness_script, no redeem_script.

Can you provide info about the specific coordinator(s) and specific conditions that would create this type of PSBT?

The test came directly from item 1 in this issue #931 : "Construct a multisig PSBT. Instantiate PSBTParser without loading a descriptor." Since PSBTParser has no descriptor parameter, I interpreted "no descriptor registered" as the output scope lacking witness_script/redeem_script, the fields _get_policy() needs to reconstruct the multisig policy. Without those fields, the output policy dict never matches the input policy, so no output is classified as change.
I couldn't find a specific coordinator documented as producing this shape on change outputs.