Integrate PR #57 audit hardening onto master (Dilithium/P2MR/constants) + close audit items

[BarneyChambers]

Summary

Brings the PR #57 wallet/Dilithium/P2MR/constants audit hardening up to date with current master (PR #56 + #59 "activate Taproot / close second-pass audit gaps"), reconciles the divergences between the two, and closes the remaining concrete audit items. Diff is the PR #57 work + reconciliation + audit fixes only (master's own #59 content is not part of this diff).

What's in here

Merge reconciliation (where #57 and #59 overlapped)

• Encrypted Dilithium key IV standardized on DeriveDilithiumKeyIV() with a legacy raw-keyid decrypt fallback (crypter.cpp, scriptpubkeyman.cpp).
• Dilithium script verification gated via the buried DEPLOYMENT_DILITHIUM (master/fix(consensus): activate Taproot and close second-pass audit gaps #59 design, audit-017); SCRIPT_VERIFY_DILITHIUM removed from STANDARD_SCRIPT_VERIFY_FLAGS and applied explicitly in ProduceSignature()'s solution check so Dilithium satisfactions still validate.
• chainparams: mainnet defaultAssumeValid points at the re-mined genesis (not the stale pre-remine hash).
• GetTxSigOpCost expects SCRIPT_ERR_EQUALVERIFY, matching the merged VerifyWitnessProgram (the superseded WITNESS_PUBKEYTYPE expectation was removed).

Audit fixes

• BTQ-AUDIT-021: CDilithiumKey::MakeNewKey() RNG-failure return is now checked by its callers (DilithiumWalletManager, CUnifiedKey) instead of being silently dropped.
• BTQ-AUDIT-019: added P2SH-wrapped Dilithium sigop-count test coverage (bare/multisig were already covered).
• Strengthened wallet_dilithium_send.py (issue sendtoaddress returns -1: map::at on v0.3.2-testnet despite successful broadcast #41 regression) to prove Dilithium sends are consensus-valid: mined confirmation, the Dilithium UTXO is the input actually spent, plus a sendmany case.

Audit status

All Critical/High findings from the internal audit are fixed. Remaining items are Medium/Low and non-blocking (signet placeholder challenge #4 [signet-only], doc/comment drift #3/#5/#24, accepted-with-rationale #25, pre-launch chainwork/assumevalid #27).

Test plan

• btqd + src/test/test_btq build clean
• Unit suites touched here pass (dilithium_basic_tests, dilithium_wallet_tests, scriptpubkeyman_tests, sigopcount_tests, feebumper_tests, p2mr_tests)
• wallet_dilithium_send.py regression passes (Dilithium spend confirms in a block)
• Full test_btq run is currently blocked by pre-existing inherited-test failures (bloom_tests hardcoded WIF, bip324_tests vectors) tracked in test: inherited Bitcoin test vectors fail under BTQ params (bloom_tests, bip324_tests) and abort the unit suite #60 — these are identical to master and not introduced here.

Notes

• Pre-existing test debt filed as test: inherited Bitcoin test vectors fail under BTQ params (bloom_tests, bip324_tests) and abort the unit suite #60.
• Mainnet-launch process gates (NIST KAT vectors, fuzz, ASan, perf, docs) are tracked separately and are out of scope for this PR.