Same bar as the #328 payout-split invariance KAT: prove the #333 lift of
generate_share_transaction() step-1 into compute_pplns_weight_walk() moves
ZERO weight. Embed the pre-refactor inline walk verbatim as
legacy_inline_weight_walk() and assert the helper reproduces it weight-for-
weight (per-script weights, total_weight, total_donation_weight) across a
battery: V36 decay path, pre-V36 grandparent-start + max_weight cap,
donation split, full-donation zero-addr-weight share, the insufficient-depth
guard (both throw identically), null/absent parents, and a chain exceeding the
real_chain_length window. Each weight map is then fed through the #328
payout-split SSOT and the outputs + donation asserted byte-identical, closing
the end-to-end no-payout-satoshi-drifts proof shared by the emission and
verification paths. dgb_share_test 28/28.

build_connection_coinbase_from_pplns delegates the payout split to
compute_pplns_payout_split() -- the same helper generate_share_transaction
(the share verification path, #329) calls -- instead of taking pre-resolved
payout_outputs/donation_amount. The coinbase a miner hashes per-connection and
the coinbase the share check enforces are now byte-identical on every payout
satoshi by construction: one payout implementation, not two kept in agreement.

Pure delegation + field forwarding into build_connection_coinbase_parts; no
inline payout arithmetic. dgb-tree-only. 4 delegation-identity KATs
(V36, pre-V36 finder fee, segwit/ref forwarding, value anchor); 8/8 green.
Stacks on the #328/#329 PPLNS SSOT stack.

Extract generate_share_transaction() step-1 PPLNS tracker walk into
dgb::coin::compute_pplns_weight_walk(), the producer-side counterpart of
the steps 2-3 lift in pplns_payout_split.hpp (#328). The share-verification
path and the per-connection Stratum coinbase emission path now draw one
tracker-walk implementation, so the weight map a miner hashes cannot drift
from the one the verifier enforces.

Verbatim lift: exact V36 depth-decay vs pre-V36 grandparent-start branch,
the data.py insufficient-depth guard, and the block-target/spread max_weight
cap are unchanged. Result type is deduced from the tracker (decltype) to
avoid the share_tracker.hpp <-> share_check.hpp include cycle.

KAT WeightWalkSSOTContract locks the helper contract (verbatim V36 forward +
safe-empty on null/absent parent); the unchanged generate_share_transaction
fixtures prove value-level byte-identity. dgb_share_test 27/27,
dgb_connection_coinbase_test 8/8.

Same bar as the #328 payout-split invariance KAT: prove the #333 lift of
generate_share_transaction() step-1 into compute_pplns_weight_walk() moves
ZERO weight. Embed the pre-refactor inline walk verbatim as
legacy_inline_weight_walk() and assert the helper reproduces it weight-for-
weight (per-script weights, total_weight, total_donation_weight) across a
battery: V36 decay path, pre-V36 grandparent-start + max_weight cap,
donation split, full-donation zero-addr-weight share, the insufficient-depth
guard (both throw identically), null/absent parents, and a chain exceeding the
real_chain_length window. Each weight map is then fed through the #328
payout-split SSOT and the outputs + donation asserted byte-identical, closing
the end-to-end no-payout-satoshi-drifts proof shared by the emission and
verification paths. dgb_share_test 28/28.

dgb(phase-b): extract PPLNS payout-split SSOT (weights -> consensus-sorted payout outputs)

build_connection_coinbase_from_pplns delegates the payout split to
compute_pplns_payout_split() -- the same helper generate_share_transaction
(the share verification path, #329) calls -- instead of taking pre-resolved
payout_outputs/donation_amount. The coinbase a miner hashes per-connection and
the coinbase the share check enforces are now byte-identical on every payout
satoshi by construction: one payout implementation, not two kept in agreement.

Pure delegation + field forwarding into build_connection_coinbase_parts; no
inline payout arithmetic. dgb-tree-only. 4 delegation-identity KATs
(V36, pre-V36 finder fee, segwit/ref forwarding, value anchor); 8/8 green.
Stacks on the #328/#329 PPLNS SSOT stack.

Extract generate_share_transaction() step-1 PPLNS tracker walk into
dgb::coin::compute_pplns_weight_walk(), the producer-side counterpart of
the steps 2-3 lift in pplns_payout_split.hpp (#328). The share-verification
path and the per-connection Stratum coinbase emission path now draw one
tracker-walk implementation, so the weight map a miner hashes cannot drift
from the one the verifier enforces.

Verbatim lift: exact V36 depth-decay vs pre-V36 grandparent-start branch,
the data.py insufficient-depth guard, and the block-target/spread max_weight
cap are unchanged. Result type is deduced from the tracker (decltype) to
avoid the share_tracker.hpp <-> share_check.hpp include cycle.

KAT WeightWalkSSOTContract locks the helper contract (verbatim V36 forward +
safe-empty on null/absent parent); the unchanged generate_share_transaction
fixtures prove value-level byte-identity. dgb_share_test 27/27,
dgb_connection_coinbase_test 8/8.

Same bar as the #328 payout-split invariance KAT: prove the #333 lift of
generate_share_transaction() step-1 into compute_pplns_weight_walk() moves
ZERO weight. Embed the pre-refactor inline walk verbatim as
legacy_inline_weight_walk() and assert the helper reproduces it weight-for-
weight (per-script weights, total_weight, total_donation_weight) across a
battery: V36 decay path, pre-V36 grandparent-start + max_weight cap,
donation split, full-donation zero-addr-weight share, the insufficient-depth
guard (both throw identically), null/absent parents, and a chain exceeding the
real_chain_length window. Each weight map is then fed through the #328
payout-split SSOT and the outputs + donation asserted byte-identical, closing
the end-to-end no-payout-satoshi-drifts proof shared by the emission and
verification paths. dgb_share_test 28/28.