test: add adversarial NU7 release confidence gates

[p0mvn]

Motivation

NU7's test-only branch ID previously allowed contextual tests to pass while the production node could not cross activation. With #1093 providing the production consensus ID and coherent Common dependencies, this PR adds adversarial tests that exercise both accounting and the actual node binary.

This PR is stacked on build/nu7-common-dependencies (#1093).

Solution

• Add independently calculated spending histories covering NSM seeding, fee/reward rounding, reissuance, competing forks, rejection atomicity, finalization, reopen, rollback and replay.
• Check difficulty-window enforcement before, at and after NU7, and verify production branch/dependency compatibility outside test builds.
• Exercise separately built production nodes with signed transparent spends, malformed signatures/branches/rewards, Sapling and Ironwood coinbase proofs, mempool transitions, RPC proposals, restart, invalidate/reconsider and P2P fork convergence.
• Add an old-release upgrade/recovery harness and CI jobs with retained logs, replay blocks and production-artifact checksums.

Live configurations use the production-derived reissuance schedule. Only contextual fixtures use the test-only short-chain override. Co-activation fixtures explicitly configure the empty NU6.1 lockbox disbursement required by consensus.

Testing

On #1093 head b497ca29b126c8445dcc444e3d663b861e413b25:

• Focused chain/state/consensus/RPC suite: 110 passed.
• Extended generated spending histories: 256 passed.
• Production-artifact acceptance: all 3 passed, including transparent fork convergence and malformed Sapling/Ironwood proof rejection.
• Standalone V5/V6 production readiness check: passed.
• v1.4.0 source-build → new-node recovery: passed, matching fresh replay of a 1,103-block prefix, crossing NU7 and surviving graceful/abrupt restart through height 1,110.
• Current-version recovery rehearsal: passed.
• Clippy with warnings denied, formatting, workflow/Markdown lint, Python compilation and changelog validation: passed.
• Before rebasing, three deliberate accounting mutations were detected; the production sources were restored afterward.

Local binaries used production features with the debug profile. Linux CI run 35607525444 also passed the adversarial accounting job, release-profile production readiness and all three acceptance cases, followed by the upgrade/recovery rehearsal using the published Linux v1.4.0 archive. Logs, replay blocks and the production binary checksum are retained in the nu7-upgrade-evidence artifact. See docs/nu7-release-confidence.md for commands and local evidence boundaries.

Changelog

Internal test, CI and developer-tooling work; docs/changelog/unreleased/1098.md records the explicit no-changelog exclusion.

Specifications & References

• test(consensus): cover NU7 MAX_MONEY boundaries with properties #1078: initial NSM/NU7 integration coverage
• build: use the Common NU7 dependency stack #1093: production consensus ID and Common dependency stack
• feat(protocol): expose the NU7 consensus branch common#474

Follow-up Work

• The short live chains do not reach the full production reissuance crossover; those boundaries are covered contextually.
• Shielded live tests cover coinbase proofs, not valid shielded-spend histories.
• The inherited Common Git dependencies remain a crates.io publishing prerequisite until the compatible stack is published.
• Independent consensus review is still required. Keep this PR in draft pending CI and review.