txprepare: fix withdraw returning unsigned transaction

The withdraw command was returning an unsigned raw transaction in
its 'tx' response field. This happened because signpsbt_done() used
psbt_txid() to extract utx->tx, which internally calls
wally_psbt_extract() with WALLY_PSBT_EXTRACT_NON_FINAL — stripping
all signature and witness data.

The broadcast itself succeeded because sendpsbt internally finalizes
the PSBT via psbt_final_tx(), but the 'tx' field returned to the
user had empty scriptSigs and no witness data.

Fix by finalizing the signed PSBT in signpsbt_done() and extracting
the fully signed transaction via psbt_final_tx(). The txid
verification still uses psbt_txid() (which is correct for txid
computation since txids exclude witness data).

Fixes: #8701
Changelog-Fixed: withdraw now returns a fully signed transaction in the `tx` response field.
Signed-off-by: Vincenzo Palazzo <vincenzopalazzo@member.fsf.org>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: vincenzopalazzo

plugins/txprepare.c

@@ -156,16 +156,28 @@ static struct command_result *signpsbt_done(struct command *cmd,
 	/* Replace with signed tx. */
 	tal_free(utx->tx);
 
-	/* The txid from the final should match our expectation. */
-	psbt_txid(utx, utx->psbt, &txid, &utx->tx);
+	/* The txid from the signed PSBT should match our expectation. */
+	psbt_txid(NULL, utx->psbt, &txid, NULL);
 	if (!bitcoin_txid_eq(&txid, &utx->txid)) {
 		return command_fail(cmd, LIGHTNINGD,
 				    "Signed tx changed txid? Had '%s' now '%s'",
-				    tal_hex(tmpctx,
-					    linearize_wtx(tmpctx, utx->tx)),
-				    fmt_wally_psbt(tmpctx, utx->psbt));
+				    fmt_bitcoin_txid(tmpctx, &utx->txid),
+				    fmt_bitcoin_txid(tmpctx, &txid));
 	}
 
+	/* Finalize the signed PSBT and extract the fully signed tx,
+	 * so that utx->tx contains witness data for the response. */
+	if (!psbt_finalize(utx->psbt))
+		return command_fail(cmd, LIGHTNINGD,
+				    "Signed PSBT not finalizeable: %s",
+				    fmt_wally_psbt(tmpctx, utx->psbt));
+
+	utx->tx = psbt_final_tx(utx, utx->psbt);
+	if (!utx->tx)
+		return command_fail(cmd, LIGHTNINGD,
+				    "Could not extract final tx: %s",
+				    fmt_wally_psbt(tmpctx, utx->psbt));
+
 	req = jsonrpc_request_start(cmd, "sendpsbt",
 				    sendpsbt_done, forward_error,
 				    utx);