selftest: cover the payout ledger properties this series fixes

A new `payout-ledger` self-test, 40 assertions, wired into RunSelfTest and
into `make -C src tests`. It runs against a scratch data directory and an
in-memory wallet map: it never opens wallet.dat, never touches a real datadir,
and never sends anything.

What it asserts, defect by defect:

  - a restart does not duplicate an in-flight record. A matured round is
    exploded, the process state is thrown away and reloaded from the files
    twice, and the in-flight list must still hold exactly one record per
    recipient. Both guards are checked separately -- once with the round-level
    set restored, and once with it deliberately emptied so only the
    per-recipient check against gPaying can save it. A paying file already
    containing the duplicate the old build wrote must collapse on load, with
    the attempt counts merged upwards rather than reset.

  - state updates address a slot, not a value. Two records equal in every
    field -- exactly what the old code produced -- and rescheduling or
    forgetting one must land on the one it was given.

  - the ledger file cannot be published from a stale snapshot. An older
    snapshot published after a newer one must not appear on disk, and four
    threads publishing 64 large images of the same file in different orders
    must leave it parseable and equal to the highest version, whatever order
    they finish in.

  - a payment with only a legacy comment is recognised as already paid, and
    the fallback's limits hold: it requires the right recipient, the exact
    amount and the right height; one legacy transaction cannot settle a second
    debt; a transaction carrying another round's structured metadata is never
    accepted as legacy evidence; and the structured match still wins where it
    applies.

  - grandfathered zero-hash rounds do not answer for each other, both as a
    direct test of the round comparison and end to end -- recording a txid
    against one zero-hash round must leave the other still owed.

  - the retry clock that is actually used survives a restart.

  - a forfeit is published rather than silently dropped: the ledger loses that
    recipient and only that recipient, and the round proof records it with a
    reason instead of going on advertising the address as owed.

  - on-disk compatibility, checked against the real shapes: the live
    production pending_payouts.json (amounts / blockHash / blockHeight /
    matureAtHeight and nothing else), the merged build's shape including the
    retryAfter this build no longer writes, and a round trip through this
    build.

Each assertion was verified to fail when its defect is put back: seven
mutations were applied one at a time to a scratch copy and every one was
caught. Notably, re-introducing either half of the duplicate-record fix alone
is caught by its own assertion while the other half still prevents the
duplicate -- which is the defence in depth this series was asked for, checked
rather than asserted.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/Makefile b/src/Makefile
index 1166daf..89ba559 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -192,6 +192,7 @@ tests: test_bip32 bitflash-node
         ./bitflash-node -selftest=net-message
         ./bitflash-node -selftest=consensus-limits
         ./bitflash-node -selftest=pool-stratum
+        ./bitflash-node -selftest=payout-ledger
         ./bitflash-node -selftest=parse-money
         ./bitflash-node -selftest=socks5-proxy