Confirm transactions by merkle proof and reinstate coins only on a quorum (B-83, TX-06, TX-22, TX-23, ELC-25, ELC-26, DEP-02, DEP-08, AUD-18, ADR-07)

poll_once marked a transaction confirmed on one server's `height > 0`, and
reinstate_reappeared_utxos restored a coin written off as spent outside the platform on
the active server's word alone, so a hostile active server could report a
never-relayed payout as confirmed (winner unpaid, round closed) or put a spent coin
back into a balance.

- electrum/merkle.py: pure merkle-branch verification against a block header.
- ElectrumListener.confirmation_proven(txid, height): the *other* servers are asked for
  blockchain.transaction.get_merkle; a strict majority of at least the quorum minimum
  must return a proof that recomputes to the merkle root of that block's header (block
  height and position checked too). The header is the tip the listener holds, or for an
  older block the one a majority of the quorum agrees on and that meets its own target;
  a height above our tip cannot be proven. Quorum rules are _corroborate_majority's.
- poll_once takes the listener as `network`: the active server's history only nominates
  a candidate (txid, height); the row confirms only when the proof holds, and stays
  pending otherwise. With no network nothing confirms. ConfirmationPoller wires it.
- The reconciler's late-confirmation check of failed rows (B-78) now puts each claimed
  (txid, height) to the same proof instead of counting histories.
- refresh_user splits reinstatement like a credit: find_reinstate_candidates (read-only;
  same outpoint, recorded amount, confirmed) -> corroborate_utxo_reinstatement (same
  quorum as a credit) -> reinstate_reappeared_utxos writes only what was corroborated,
  rechecking the mark under the lock. Nothing is committed in the read phase any more.
- Broadcast fan-out, the third part of the finding, shipped with B-76.

Tests changed because the spec changed: every poll_once call now passes a network that
proves (FakeNetwork) — the confirmation tests are otherwise unchanged; the failed-row
"quorum does not confirm" test now asserts the claim goes to the proof.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_reconcile_proof.py

@@ -326,22 +326,23 @@ async def test_an_earlier_version_of_a_failed_row_that_confirms_is_resurrected_t
     assert row.status == "confirmed" and row.current_txid == "older-txid"
 
 
-async def test_a_failed_row_the_quorum_does_not_confirm_stays_failed(session_factory):
-    """Only the active server (or only a minority of the others) says it is mined."""
+async def test_a_failed_row_is_resurrected_only_when_the_quorum_proves_it(session_factory):
+    """The histories only name a claim (txid, height); the quorum's merkle proofs decide
+    (B-83, TX-22). A claim made by the active server alone, or one the proofs do not bear
+    out, leaves the row failed and the lottery running."""
     await _seed_failed_withdrawal(session_factory)
     mined = [{"tx_hash": "wdtxid", "height": 321}]
 
-    hostile_active = ScriptedNetwork(active=mined, others=([], []))
-    assert await reconcile_once(session_factory, UnknownTxClient(), hostile_active) == 0
-    minority = ScriptedNetwork(active=mined, others=(mined, [], []), others_needed=2)
-    assert await reconcile_once(session_factory, UnknownTxClient(), minority) == 0
-    too_few = ScriptedNetwork(active=mined, others=(mined, None), others_needed=2)
-    assert await reconcile_once(session_factory, UnknownTxClient(), too_few) == 0
+    unproven = ScriptedNetwork(active=mined, others=([], []), proven=False)
+    assert await reconcile_once(session_factory, UnknownTxClient(), unproven) == 0
+    assert unproven.proofs_asked == [("wdtxid", 321)]  # the claim was put to the quorum
+
+    assert await reconcile_once(session_factory, UnknownTxClient()) == 0  # no network: nothing to prove with
 
     assert (await _row(session_factory)).status == "failed"
     async with session_factory() as session:
         config = (await session.scalars(select(RoundConfig))).first()
-        assert config is None or not config.paused  # no pause without the quorum
+        assert config is None or not config.paused  # no pause without the proof
 
 
 async def test_a_failed_row_is_watched_for_fourteen_days_and_no_longer(session_factory):