[NicolasDorier]

Summary

This hardens several public parsing, signing, and transaction-building paths so malformed or internally inconsistent inputs fail predictably instead of being accepted, misinterpreted, or producing unrelated exceptions.

• Reject invalid Base58 and Bech32 data safely, including non-ASCII Base58 characters and long Bech32 strings with invalid checksums.
• Keep PSBT input metadata consistent, preserve independent CoinJoin copies, and validate input and output indexes.
• Validate key relationships, taproot script signatures, and Miniscript key requirements before use.
• Reject splitting negative amounts, conflicting coin metadata, and invalid transaction-builder fee or output-subtraction requests.

Compatibility

Callers that previously supplied mismatched extended keys, inconsistent PSBT UTXO records, negative amounts to Split(), conflicting metadata for one outpoint, or invalid builder indexes will now receive validation errors. Identical coins may still be shared across builder groups, and other valid inputs retain their existing behavior.