feat(frost/signing): RFC-21 Phase 1B -- optional AttemptContextHash field

Extends the three FROST/tbtc-signer protocol message types with an
optional 32-byte AttemptContextHash field that binds the message to a
specific RFC-21 AttemptContext (introduced in Phase 1A).

* nativeFROSTRoundOneCommitmentMessage
* nativeFROSTRoundTwoSignatureShareMessage
* buildTaggedTBTCSignerRoundContributionMessage

Migration contract (Phase 1B intentionally limited):
* Field uses omitempty -- absent on the wire when the sender has not
  bound the message to a context. Old peers continue to interop.
* Receiver-side Unmarshal validates length-when-present (must be
  exactly AttemptContextHashFieldLength = 32) but does not yet match
  against the locally-computed context. Higher-level acceptance lands
  in a later RFC-21 phase behind a build tag.
* Shared helpers in attempt_context_binding.go convert between the
  on-wire []byte form and the canonical [32]byte hash form. Senders
  use SetAttemptContextHash; receivers use GetAttemptContextHash to
  get the hash + presence flag.

Equal-or-reject is extended to compare AttemptContextHash bytewise,
so a peer that retransmits the same contribution but mutates the
binding mid-stream triggers the existing first-write-wins reject
path (introduced in PR #3959).

17 new tests cover: length validation; array<->slice round-trip
without caller aliasing; per-message marshal/unmarshal round-trip
with field absent and present; backward compatibility with
pre-Phase-1B JSON; wrong-length rejection; equal-or-reject
sensitivity to the new field. All pass under
`go test -tags 'frost_native frost_tbtc_signer' ./pkg/frost/...`
plus the pkg/tbtc regression subset.

Refs RFC-21 (docs/rfc/rfc-21-*); stacked on Phase 1A (#3963).

Author: mswilkison

pkg/frost/signing/attempt_context_binding.go

@@ -0,0 +1,70 @@
+package signing
+
+import (
+	"fmt"
+
+	"github.com/keep-network/keep-core/pkg/frost/roast/attempt"
+)
+
+// AttemptContextHashFieldLength is the on-wire byte length of the
+// optional AttemptContextHash field carried by the FROST/tbtc-signer
+// protocol messages. The field is the canonical SHA-256 hash of the
+// AttemptContext (see pkg/frost/roast/attempt), so 32 bytes.
+const AttemptContextHashFieldLength = attempt.MessageDigestLength
+
+// validateAttemptContextHashField checks the length invariant for the
+// optional AttemptContextHash field on protocol messages. An absent
+// field (nil or zero-length slice) is valid; a present field must
+// match AttemptContextHashFieldLength exactly.
+//
+// This is the only validation Phase 1B performs on the field. Higher-
+// level acceptance (the receiver-side check that the hash matches the
+// locally-computed AttemptContext) lands in a later RFC-21 phase
+// behind a build tag, since enabling it requires honest peers to have
+// rolled out the new field first.
+func validateAttemptContextHashField(field []byte) error {
+	if len(field) == 0 {
+		return nil
+	}
+	if len(field) != AttemptContextHashFieldLength {
+		return fmt.Errorf(
+			"attempt context hash field has wrong length [%d], expected [%d] or absent",
+			len(field),
+			AttemptContextHashFieldLength,
+		)
+	}
+	return nil
+}
+
+// attemptContextHashFieldFromArray converts a fixed-size 32-byte hash
+// into the slice form used on the wire. Returns a fresh slice so the
+// caller's array cannot be mutated through the returned reference.
+func attemptContextHashFieldFromArray(
+	hash [AttemptContextHashFieldLength]byte,
+) []byte {
+	out := make([]byte, AttemptContextHashFieldLength)
+	copy(out, hash[:])
+	return out
+}
+
+// attemptContextHashFieldToArray converts a wire-form slice back to
+// a fixed-size 32-byte hash plus a presence flag. Returns
+// (zeroArray, false) when the field is absent. Caller has already
+// validated length via validateAttemptContextHashField; this function
+// trusts that invariant and panics on violation.
+func attemptContextHashFieldToArray(
+	field []byte,
+) ([AttemptContextHashFieldLength]byte, bool) {
+	var out [AttemptContextHashFieldLength]byte
+	if len(field) == 0 {
+		return out, false
+	}
+	if len(field) != AttemptContextHashFieldLength {
+		panic(fmt.Sprintf(
+			"attemptContextHashFieldToArray called with wrong-length field [%d]",
+			len(field),
+		))
+	}
+	copy(out[:], field)
+	return out, true
+}