#33112 wallet: relax external_signer flag constraints

• Allow wallets to combine external signing devices with internal keys
• Remove the restriction that forces external signer wallets to be watch-only and immutable

This pull request relaxes constraints on the `external_signer` wallet flag in Bitcoin Core. It removes the requirement that external signer wallets must have private keys disabled, makes the `external_signer` flag mutable via `setwalletflag` (automatically reloading the wallet when toggled), ensures blank signer wallets do not auto-import keys, and allows the wallet to sign with internal keys before delegating remaining inputs to the external signer.

Problem: Previously, the `external_signer` flag forced a wallet to be watch-only and immutable from creation, which blocked multisig or MuSig2 setups where the node holds both a hot key and relies on an external signer device.

P2 · new feature

• P2 because it unlocks hybrid key management combining external signers and hot keys in one wallet
• Unblocks multisig and future MuSig2 wallet workflows that use hardware devices

P2 because it unlocks new hybrid key-management capabilities for external signers and unblocks future MuSig2 wallet workflows. PraneethGunas noted that this 'greatly helps unblock using external signers and hot keys in the same wallet for a multisig setup'.

Membership: Modifies core wallet flags, descriptor script pubkey managers, and wallet RPCs.

Factors: security/stability 1, bug 0, performance 0, user value 2, leverage 2

• Ready for review with CI passing and previous feedback addressed

The PR is rebased, passing CI, and has addressed all raised concerns from previous review rounds.

Author status: active

Resolved concerns:

• jeanpablojp noted that toggling `external_signer` on an existing wallet caused descriptor SPKM mismatches unless reloaded; author addressed this by triggering an automatic wallet reload on flag change.
• jeanpablojp noted lack of `ENABLE_EXTERNAL_SIGNER` guards in `setwalletflag`; author added compile guards.
• PraneethGunas found that importing hot keys into an external signer wallet caused `FillPSBT` to fail on hardware signers; author updated `FillPSBT` to sign local keys first, which PraneethGunas verified on a Ledger Flex.

• Strong consensus across multiple reviewers with previous concerns resolved
• Concept approval without stated reasons (achow101)
• Verified by testing on Ledger Flex hardware with hot descriptor signing (PraneethGunas)
• Verified by testing Qt and CLI workflows (adyshimony, rkrux)

Strong consensus on design and implementation; objections resolved and verified with hardware testing (rkrux, PraneethGunas, adyshimony, achow101).

Multiple maintainers and contributors have expressed Concept ACKs and tested ACKs. Specific edge cases around hot-key fallback and wallet reloading were addressed by the author and verified by the reviewers.

• achow101 Concept ACK
• rkrux tested ACK on earlier commits and re-ACKed after revisions
• adyshimony tested Qt and CLI workflows and gave ACK
• PraneethGunas tested on Ledger Flex hardware and confirmed fix for hot descriptor signing

Review verdicts (DrahtBot): 0 (+3)

• Stale ACK: rkrux, adyshimony, PraneethGunas
• Concept ACK: naiyoma, achow101, jeanpablojp

Enables:

• MuSig2 multisig support with external signers

132 lines under test/bench/ci.

• src/wallet/rpc/wallet.cpp +115/-46
• test/functional/wallet_signer.py +83/-36
• src/wallet/wallet.cpp +19/-17
• src/qt/createwalletdialog.cpp +8/-20
• src/wallet/external_signer_scriptpubkeyman.cpp +24/-4
• src/wallet/wallet.h +11/-7
• test/functional/rpc_signer.py +0/-5
• test/functional/test_framework/test_framework.py +5/-0
• test/functional/wallet_avoidreuse.py +3/-0
• src/qt/walletmodel.cpp +1/-1
• src/wallet/external_signer_scriptpubkeyman.h +1/-0

This PR relaxes constraints on external signer wallets in Bitcoin Core by allowing private keys to remain enabled and making the external_signer flag mutable via setwalletflag. This enables hybrid setups where a wallet contains both hot keys and external signer keys, which is a required prerequisite for MuSig2 and multisig hardware signer integration. Reviewers had previously flagged issues with SPKM construction during flag toggling and hot key PSBT signing, both of which have been resolved and verified with physical hardware testing. The PR is clean and ready for final review.