Make RGB channel funding restart-safe

[Jainakin]

Summary

Make inbound RGB channel funding transactional across process failure, monitor persistence, signer delay, reconnect, and retry.

The change replaces the previous one-shot FundingCreated acceptance path with an explicit prepare, promote, finalize, rollback, and startup-reconciliation protocol. funding_signed is not released until both the initial channel monitor and the staged RGB state are durable. Persisted completion actions allow interrupted work to resume after restart without accepting the same RGB allocation twice.

It also restores the RGB-aware test surface that had drifted behind the UTEXO LDK fork, including route, wire-format, monitor serialization, signer, and fixture coverage required to exercise the new state machine.

Root cause

The former path mutated RGB state synchronously during FundingCreated and then advanced the Lightning channel independently. A crash, peer disconnect, delayed signer, failed monitor persistence, or replay could therefore leave the RGB stock and LDK channel state on opposite sides of the funding boundary.

Safety model

• Prepare RGB acceptance in isolated durable state.
• Re-check peer/session ownership before promotion.
• Promote the exact prepared operation idempotently.
• Persist a required monitor-completion action before releasing funding_signed.
• Finalize only after the initial monitor is durable.
• Roll back pre-broadcast failures deterministically.
• Reconcile incomplete operations during ChannelManager startup.
• Preserve the latest commitment fascia per channel side.
• Treat monitor-update partial payment results as in-flight, not resend-safe.

Dependencies

• Batch Electrum witness resolution rgb-protocol/rgb-ops#18
• Add isolated RGB stock snapshots rgb-protocol/rgb-ops#19
• Batch Electrum witnesses during RGB transfer import rgb-lib#79
• Make RGB acceptance transactional and crash-safe rgb-lib#80

The Cargo references intentionally point at the contributor branches while this stack is under review. They must be replaced with merged revisions before release.

Validation

• cargo check -p lightning --features _rln_test_hooks on the forward port to current dev.
• Full modified Rust Lightning suite on the experimental revision: 1,188 passed; 9 ignored.
• RLN integration coverage exercises forced abort, restart, retry, async signer, monitor persistence, and final-balance invariants in the downstream PRs.

Review notes

This PR is intentionally draft. It is security-sensitive and changes persisted channel state. Merge requires the dependency stack, Linux CI, sanitizer coverage, and downstream RLN interoperability to be green.

The branch also carries compatibility/test repairs needed to compile the UTEXO RGB fork's previously disabled upstream tests. Those changes are visible rather than hidden as generated churn; reviewers can request a further split after the state-machine design is accepted.