test(tbtc): multi-signer simulated integration test for reservation coordination - #4279

…oordination

Implementation-plan.md Milestone 3, 'multi-signer simulated
integration test' item (per user decision: build the test, leave the
testnet-drill item as an agent-not-actionable tracked item since it
needs live infra and calendar time, not code).

Scales TestCoordinationExecutor_Coordinate's existing 3-operator
harness - deterministic keypairs, real per-operator localChain fakes,
a real shared netlocal.BroadcastChannel, one goroutine per operator
running coordinationExecutor.coordinate concurrently - to
ReservationAnchorProposal and ReservationReanchorProposal. This
exercises the real leader/follower coordination round-trip
(checklist generation -> leader election -> broadcast -> follower
validation -> convergence) that no mocked pkg/tbtcpg unit test can
cover, since those call task.Run(request) directly and never go
through coordinationExecutor.coordinate. It also exercises PR
#4277's protobuf marshaling of both proposal types over a real wire
round-trip, since every follower unmarshals the leader's broadcast
coordinationMessage.

Depends on PR #4278 (this branch's parent): before that fix,
ActionReservationAnchor/ActionReservationReanchor never appeared in
getActionsChecklist's output, so every operator's checklist search in
these tests would fall through to NoopProposal and fail - confirmed
by temporarily reverting the checklist fix and re-running (both new
tests failed with the expected NoopProposal mismatch), then restoring
it.

Found and fixed one bug in this test's own harness during
verification: both new tests initially shared one netlocal broadcast
channel name. getBroadcastChannel's registry is keyed by name and
never releases old channels, so under -race (which changed
goroutine/channel-delivery timing enough to surface it in ~every
run), the reanchor test's follower sometimes received a stale
broadcast left over from the anchor test's leader. Fixed by giving
each test its own channel name; re-verified stable across 10
repeated -race runs plus the full non-race and race suites.

Testing:
- go test ./pkg/tbtc/...: 365/365 pass.
- go test -race ./pkg/tbtc/...: clean, no data races, including
  -count=10 on just the two new tests.
- go build ./... && go test ./...: full repo, 49 packages, zero FAIL.
- gofmt -l / go vet: clean.

Resolves all 11 confirmed findings from review of the reservation
multi-signer coordination test:

- Bound runReservationCoordinationRound's report wait with a 30s
  timeout instead of an unbounded channel receive: at
  coordinationBlock=24562800, coordinate()'s only cancel path takes
  ~28 simulated days to fire, so any follower-rejects-proposal
  regression would hang the goroutine and the test forever, killing
  every other pkg/tbtc test via the package-wide go test timeout.

- Derive each test's broadcast channel name from t.Name() plus a
  per-invocation nonce instead of a hardcoded literal: the
  coordination leader intentionally keeps retransmitting for the
  active phase's duration, so a hardcoded name risks an earlier
  invocation's leader retransmitting into a later invocation's
  followers under -count=N or a future test reusing the name.

- Migrate TestCoordinationExecutor_Coordinate onto the shared
  reservation-coordination helpers instead of its own duplicated
  inline fixture/report/sort logic, and collapse
  TestCoordinationExecutor_Coordinate_ReservationAnchor/Reanchor into
  one table-driven TestCoordinationExecutor_Coordinate_ReservationProposals.

- Drop the now-unused sort in runReservationCoordinationRound (no
  assertion depended on report order) and the tautological
  reports-count assertions.

- Stop aliasing the mock generator's returned pointer as the expected
  result in assertions, so the leader-side comparison isn't a
  vacuous pointer-identity check.

- Correct four doc comments that overclaimed shared-state absence,
  stale branch provenance, and reanchor test chronology; add the
  missing public-key-hash comment in newReservationCoordinationWallet.

Verified: go build ./..., go vet ./pkg/tbtc/..., gofmt clean,
go test ./pkg/tbtc/... (145s, all pass), and the three affected
tests under -race -count=10 (clean).

Removing the tautological reports-count assertion (previous commit)
also removed the only check that all three operators actually
reported: len(reports) == len(operators) holds by loop construction
regardless of *which* operators reported, so a fan-in bug returning
two reports for one operator while another's is lost would pass
silently. Add an explicit check in runReservationCoordinationRound
(which owns the fan-in) that every operator index 1..len(operators)
appears at least once among the collected reports.

Verified: go build ./..., go vet ./pkg/tbtc/..., gofmt clean,
the three affected tests individually confirmed via raw (non-
summarized) test output, -race -count=10 clean, and the full
pkg/tbtc suite (146s, all pass).

…eports"

This reverts commit 276e64b.

Root-causes finding P1-#2's minimum fix (unique channel name per test
invocation, previous commit): pkg/net/local's broadcastChannels registry
is append-only and process-global, and each retransmission ticker was
started with context.Background(), so it retransmits forever with no
way to stop it externally. A later test/invocation reusing a channel
name would keep receiving an earlier invocation's stale, still-
retransmitting messages for the lifetime of the test binary - three
pre-existing tests (ExecuteLeaderRoutine, ExecuteFollowerRoutine,
ExecuteFollowerRoutine_WithIdleLeader) still hardcode "test"/"test-idle"
and were never covered by the minimum fix.

- pkg/net/local/broadcast_channel_manager.go: give each channel a
  cancellable context instead of context.Background(), track the
  cancel funcs, and add ResetForTesting() to cancel every outstanding
  ticker and clear the registry.
- pkg/tbtc/coordination_test.go: wire t.Cleanup(netlocal.ResetForTesting)
  into all four broadcast-channel-creation sites in this file (the
  shared reservation-coordination helper plus the three pre-existing
  hardcoded-name tests), so every test starts from an empty registry
  regardless of channel-name convention - removing the need for the
  per-invocation-nonce workaround to be the only safeguard.

Verified: go build ./..., go vet ./pkg/tbtc/... ./pkg/net/local/...,
gofmt clean. All 5 affected tests together under -race -count=10
(50/50 pass, proving cross-invocation isolation actually holds now).
Full pkg/net/local and pkg/tbtc suites pass (145s).

ResetForTesting (previous commit) already makes channel-name reuse
safe by cancelling every outstanding ticker and clearing the registry
between invocations - proven experimentally: forcing all operators
onto one fixed colliding name still passed 20/20 under -race -count=10
with the hook active, and failed under the same forced collision with
the hook disabled (reanchor received a stale anchor proposal from an
earlier subtest's still-retransmitting leader).

The per-invocation time.Now().UnixNano() nonce was therefore dead
weight, and the doc comment claiming a name "should be unique per
test invocation" was no longer true. Dropped the nonce (channelName
is now just t.Name(), kept for attributing a leak to its source test,
not for uniqueness) and rewrote the comment to describe the actual
current invariant.

Verified: go build ./..., go vet ./pkg/tbtc/..., gofmt clean. The five
netlocal-using tests together under -race -count=20 (100/100 pass,
genuine repeated-invocation collision on the same fixed name, not a
synthetic one). Full pkg/tbtc suite (146s) green.

…r cleanup

- Rescope ResetForTesting to a name-keyed ReleaseBroadcastChannel(name)
  instead of wiping the entire process-global channel registry, so
  tests (and any future caller) can release one channel without
  destroying every other channel's retransmission ticker.
- Guard the retransmission Ticker's post-loop handler cleanup with the
  same mutex used everywhere else in the type, closing a race between
  concurrent onTick/onUnregister callers and ticker shutdown.
- Add TestReleaseBroadcastChannel covering release-stops-retransmission
  and reuse-after-release-only-delivers-to-the-new-channel behavior.

- Fix checklist-ordering doc comment to match the actual actionPriority
  map.
- Hoist the 30s fan-in deadline outside the report-collection loop so
  it bounds the whole wait instead of re-arming on every report.
- Rewrite the protocolLatch doc comment: it does not serialize
  concurrent operator goroutines, only bounds in-flight work.
- Rename reservationCoordination* test helpers to drop the misleading
  "reservation" prefix; they exercise the general coordination path.
- Fix the leader-goroutine/waiter leak in waitForBlockHeight by
  translating the requested absolute block height into the local
  chain fake's own relative counter frame before waiting, instead of
  waiting on the raw absolute height (which could take days of
  simulated block time to reach for mainnet-scale values).
- Correct the fixture doc comment's chain-sharing overclaim.
- Fix coordination.go's redemption-priority comment to describe the
  actual post-activation gating behavior.
- Rename TestReservationProposals_UnmarshalRejectsMissingIntegers to
  TestReservationProposals_UnmarshalRejectsInvalidPayloads, matching
  what the test actually covers.