Backport tBTC-relevant BNB v4 hardening

[mswilkison]

Summary

Stacked on #2. This draft backports the BNB bnb-chain#332 fixes that map cleanly to Threshold's current ECDSA/tBTC path without taking BNB's v4 module-path churn or EdDSA/package cleanup.

Included:

• Bound additional verifier-controlled response scalars before modular exponentiation:
  • DLN Alpha and nil input guards.
  • Threshold Paillier FactorProof W1, W2, Sigma, and V absolute bounds.
  • MtA/RangeProof exact upper-bound rejection and nil modulus guards.
• Harden panic-DoS paths used by ECDSA signing/keygen:
  • ECPoint scalar multiplication returns nil on invalid inputs.
  • Schnorr proof verifiers reject invalid public points and zero/out-of-range scalars before scalar multiplication.
  • VSS share verification rejects nil, zero, and out-of-range shares/verifiers before scalar multiplication.
  • ECDSA signing round 4 rejects nil theta inverse.
  • ECDSA signing round 9 fixes the decommitment guard from && to ||.
• Add mta.ErrRangeProofVerify and signing-round attribution text for peer range-proof rejection.
• Reject non-2048-bit Paillier/NTilde values in ECDSA keygen round-1 message validation, matching the later round-2 contract.

Review follow-up:

• Removed unused ScalarMultErr / ScalarBaseMultErr public API surface.
• Confirmed the only production BobMid / BobMidWC callers are in ecdsa/signing/round_2.go, where mta.ErrRangeProofVerify attribution is now wired.
• Added comments around the MtA and FactorProof response bounds to document why MtA uses exclusive upper bounds while Threshold FactorProof keeps its existing inclusive absolute-bound style.
• The stricter DLN Alpha check is verifier-only tightening. Honest provers already produce Alpha in (1, N); this rejects malformed values that previously only passed after reduction modulo N.
• Stabilized a pre-existing EdDSA keygen test flake exposed by CI by passing the reconstructed scalar to edwards.PrivKeyFromScalar as a fixed-width 32-byte buffer.
• Pinned the existing DLN nil-proof-element rejection with a no-panic regression test for nil Alpha and nil T entries.
• Made the ProofBobWC.Verify nil result check after xE.Add(pf.U) explicit.
• Added regression tests for the round-9 decommitment-length guard (extracted as decommitFour, mutation-detectable against the &&→|| fix) and the just-below-2048 boundary of the keygen/resharing hasBitLen checks.

Not included in this draft:

• BNB's v4 module path/import churn.
• EdDSA removal or EdDSA-specific API cleanup.
• BNB v4: security fixes (12 audit findings + module bump) bnb-chain/tss-lib#332's constant-time Paillier default. Our fork does not currently carry the upstream constant-time framework; that remains a separate, larger side-channel hardening project as noted in Integrate BNB tss-lib hardening #2.
• BNB v4: security fixes (12 audit findings + module bump) bnb-chain/tss-lib#332's new KGRound2Message2 NTilde proof field. Threshold's fork already carries and verifies modproof_tilde in ECDSA keygen round 1, so this needs separate review before adding another wire field.

Validation

• go test -count=1 ./crypto ./crypto/dlnproof ./crypto/mta ./crypto/paillier ./crypto/schnorr ./crypto/vss ./ecdsa/keygen ./ecdsa/signing
• go test -count=1 ./ecdsa/resharing
• go test -count=1 ./eddsa/keygen ./eddsa/signing ./eddsa/resharing
• go test -count=1 ./crypto/mta ./ecdsa/signing after the final MtA nil-guard tweak
• go test -count=1 -timeout 25m ./ecdsa/keygen after the review follow-up commit
• go test -count=1 -timeout 25m ./eddsa/keygen after the CI scalar-width flake fix
• go test -count=1 ./crypto/dlnproof ./crypto/mta after the Gemini follow-up commit
• git diff --check
• go test -count=1 -run TestDecommitFour ./ecdsa/signing and go test -count=1 -timeout 25m ./ecdsa/keygen ./ecdsa/resharing after the new test additions.