#35747 wallet: Fix FillPSBT failing to sign owned inputs when UTXOs disagree

• Prevent unexpected PSBT signing failures when external coordinators provide conflicting UTXO data
• Ensure the wallet can still reliably sign owned inputs from buggy or adversarial coordinators

Updates `DescriptorScriptPubKeyMan::FillPSBT` to look up an input's UTXO via `PSBTInput::GetUTXO` rather than directly inspecting `witness_utxo`. This ensures key lookup prefers a valid `non_witness_utxo` and rejects invalid inputs consistently with `SignPSBTInput`.

Problem: When a PSBT input carries both `witness_utxo` and `non_witness_utxo` with conflicting scripts, `FillPSBT` previously selected signing keys based on `witness_utxo` while `SignPSBTInput` attempted to sign for `non_witness_utxo`, causing signing to fail unexpectedly even when the wallet owned the input.

P3 · bug fix

• P3 because it fixes an edge-case bug where signing fails on owned inputs with conflicting UTXO data
• Funds are never at risk since the bug only caused incomplete signing rather than signing the wrong UTXO

P3 because this fixes an edge-case bug where PSBT signing fails for owned inputs on inputs with conflicting UTXO data. As the author notes, 'the risk with the old FillPSBT behavior is just that signing fails or stays incomplete. We'd never sign the wrong utxo', meaning fund safety is never compromised.

Membership: Changes DescriptorScriptPubKeyMan key lookup in src/wallet/scriptpubkeyman.cpp and adds wallet PSBT unit tests.

Factors: security/stability 1, bug 1, performance 0, user value 1, leverage 0

• Needs rebase due to merge conflicts with master

The PR has merge conflicts with current master and requires a rebase.

Author status: silent since 2026-08-15 force-push

Resolved concerns:

• vicjuma inquired whether internal logic could ever produce conflicting UTXOs and what risks were involved; nervana21 clarified that this addresses mutated or buggy external coordinator PSBTs and cannot lead to signing the wrong UTXO.

• Neutral sentiment with no explicit ACKs yet
• Asked clarifying questions on the threat model and risks of conflicting UTXOs (vicjuma)

Neutral; vicjuma raised questions about the attack model and risks which the author answered, with no follow-up.

No explicit Concept ACKs or code ACKs have been posted. A reviewer asked clarifying questions on motivation and threat model, which the author answered satisfactorily without further objections.

• vicjuma questioned the scenario where UTXOs disagree and the associated risks
• nervana21 explained that a buggy or adversarial coordinator could cause signing to fail and that funds are not at risk

Review verdicts (DrahtBot): 0

84 lines under test/bench/ci.

• src/test/psbt_tests.cpp +44/-0
• src/wallet/test/psbt_wallet_tests.cpp +40/-0
• src/wallet/scriptpubkeyman.cpp +4/-7
• src/psbt.h +5/-0

Fixes FillPSBT in the wallet to select signing providers using PSBTInput::GetUTXO instead of inspecting witness_utxo directly. This solves an issue where an input with conflicting witness and non-witness UTXO fields caused FillPSBT to fetch keys for one script while SignPSBTInput expected another, failing to sign valid owned inputs. Fund safety is not affected as signing never produced invalid or incorrect signatures. The change currently needs a rebase and has neutral discussion with no formal ACKs yet.