spec(frost/roast): normative coordinator-seed derivation annex + cross-language conformance vectors

The coordinator-shuffle seed existed in two divergent implementations:
the Go RFC-21 layer derives fold(SHA256(KeyGroup || SessionID ||
MessageDigest)) with 0-based attempt numbers, while the Rust signer's
attempt-context validation used the first 8 bytes of the raw message
digest with 1-based wire attempts (the legacy signingAttemptSeed
convention). Flagged in #4026; at Phase-7 wiring every Go-derived
attempt context would fail Rust-side validation.

This PR makes the Go derivation normative and durable:

- RFC-21 Annex A (normative) specifies the derivation, the
  KeyGroupBytes definition for FrostTBTCSignerV1 material, the
  0-based/1-based wire mapping (wire = AttemptNumber + 1), wrapping
  semantics, and the accepted non-goals (unframed concatenation,
  first-8-bytes fold, grindability bounds) with rationale.
- pkg/frost/roast/testdata/coordinator_seed_vectors.json pins ten
  end-to-end vectors (seed int64 + selected coordinator), covering
  attempt 0/1/5/3/7, sparse and production-size (n=100) member sets,
  opaque key-group handles, and negative folded seeds. The file is
  regenerated from the Go implementation via
  ROAST_SEED_VECTORS_REGEN=1 (TestRegenerateCoordinatorSeedVectors),
  so the vectors provably come from the spec'd input matrix.
- TestCoordinatorSeedDerivation_ConformanceVectors consumes the file
  and pins DeriveAttemptSeed -> foldAttemptSeed -> SelectCoordinator
  end to end, including the wire-mapping invariant and at least one
  negative-seed pin so an unsigned port cannot pass.

The Rust signer adopts the same derivation and a byte-identical
vector copy in the paired PR stacked on #4005.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mswilkison

docs/rfc/rfc-21-roast-coordinator-retry-and-transition-evidence.adoc

@@ -732,6 +732,83 @@ gossiped attestations *are* the persistent record.
   signer remains a single-process engine; coordinator state lives on
   the keep-core side.
 
+== Annex A (normative): coordinator-shuffle seed derivation
+
+This annex is the single normative definition of the coordinator-
+shuffle seed. Two independent implementations exist -- the Go RFC-21
+layer (`pkg/frost/roast`) and the Rust tbtc-signer attempt-context
+validation (`pkg/tbtc/signer/src/engine.rs`) -- and both MUST derive
+byte-identical values from this text. Conformance is pinned by the
+shared vector file regenerated from the Go implementation
+(`pkg/frost/roast/testdata/coordinator_seed_vectors.json`, mirrored
+byte-identically to `pkg/tbtc/signer/testdata/`); any divergence
+fails the drifting side's own unit suite.
+
+=== Inputs
+
+* `KeyGroupBytes`: the UTF-8 bytes of the canonical FROST key-group
+  handle. For `FrostTBTCSignerV1` signer material this handle is the
+  lowercase hex encoding of the serialized group verifying key as
+  produced by the tbtc-signer engine (the `KeyGroup` string), and
+  `ExtractDkgGroupPublicKeyFromMaterial` returns exactly these bytes.
+  The handle is treated as an opaque byte string; implementations
+  MUST NOT decode it to point bytes before hashing.
+* `SessionID`: the session identifier's raw UTF-8 bytes.
+* `MessageDigest`: the 32-byte signing message digest.
+* `AttemptNumber`: the RFC-21 attempt number, **0-based** (attempt
+  zero is the first attempt). The tbtc-signer FFI `AttemptContext`
+  carries `wire_attempt_number = AttemptNumber + 1` (1-based, zero
+  rejected); implementations consuming the wire form MUST subtract
+  one before the composition below.
+* `IncludedSet`: the attempt's included member indices.
+
+=== Derivation
+
+----
+AttemptSeed32   = SHA256(KeyGroupBytes || SessionID || MessageDigest)
+ShuffleSeed_i64 = int64_from_be_bytes(AttemptSeed32[0..8])
+SourceSeed_i64  = ShuffleSeed_i64 + int64(AttemptNumber)      // two's-complement wrap
+Coordinator     = GoMathRandShuffle(sort_ascending(IncludedSet), SourceSeed_i64)[0]
+----
+
+`GoMathRandShuffle` is the exact shuffle of Go's legacy `math/rand`:
+`rand.New(rand.NewSource(seed)).Shuffle` -- ported bit-exactly to
+Rust in `pkg/tbtc/signer/src/go_math_rand.rs` and pinned by the
+cross-language vectors of keep-core PRs #4026/#4027. The addition is
+two's-complement wrapping on both sides (Go's defined signed
+overflow; Rust `wrapping_add`).
+
+=== Non-goals and accepted properties
+
+* The concatenation `KeyGroupBytes || SessionID || MessageDigest` is
+  not length-framed, so input-boundary collisions are theoretically
+  expressible. This is accepted: the seed feeds a *non-cryptographic*
+  shuffle whose only job is deterministic agreement on rotation
+  order among honest members; every input is independently and
+  unambiguously bound (and framed) in the `AttemptContext` hash that
+  protocol messages verify. The seed is not a security boundary, and
+  no exclusion or signing decision may ever be derived from it.
+* Only the first 8 bytes of `AttemptSeed32` influence the shuffle;
+  the remaining 24 bytes are bound via the `AttemptContext` hash
+  only.
+* Grindability: an adversary who can choose `SessionID` or
+  `MessageDigest` can bias coordinator rotation order. Session and
+  message identifiers are protocol-fixed inputs (deposit/redemption
+  driven), not free adversary choices; rotation-order bias degrades
+  at worst into the serial-attempt latency bound, never into a
+  safety property.
+
+=== History
+
+Before this annex, the two implementations diverged: the Go layer
+derived `fold(SHA256(KeyGroup || SessionID || MessageDigest))` with
+0-based attempts while the Rust engine used the first 8 bytes of the
+raw `MessageDigest` with 1-based wire attempts (the legacy
+`signingAttemptSeed` convention of the pre-ROAST signing loop, which
+`pkg/tbtc/signing_loop.go` retains until Phase-7 migrates it to this
+annex). The divergence was flagged in keep-core PR #4026 and resolved
+by adopting the Go derivation as normative.
+
 == References
 
 * Ruffing, Ronge, Aranha, Schneider. ``ROAST: Robust Asynchronous