fix: re-sign a pending EHF signal on every block so a failed first attempt can recover - #8129

78ad074 Merge #8131: fix: wait for a matching superblock trigger before voting NO on the others (merge-script)
6faa5ce Merge #8097: fix: keep governance triggers across a restart on test networks (pasta)
2757e83 Merge #8130: fix: process a node's own DKG messages ahead of queued peer messages (merge-script)
cbbee0e Merge #8135: perf: keep verified DKG contributions cached through the commit phase (merge-script)
29a3cdd Merge #8099: fix(rest): don't terminate on blocks with undecodable ProTx payloads (merge-script)
275a142 Merge #8100: fix: don't abort in governance when a reorg changes masternode internal ids (merge-script)
d00c4e6 Merge #8104: fix: keep final commitments mineable when their block is rejected (merge-script)
b051d3a Merge #8080: test(qt): stop address book tests from answering the shared masternode wizard's prompt (merge-script)
ec9e944 Merge #8094: fix(net): stop busy-looping while a peer's send buffer is full (merge-script)
033dae3 Merge #8052: fix(qt): reserve the same shared masternode contribution again after a release (merge-script)
65603d5 Merge #8088: fix: fetch miniupnpc sources from miniupnp.free.fr (merge-script)

Pull request description:

  ## Issue being fixed or feature implemented

  Backports for v24.0.1, on top of `v24.0.x` at 938fba5 (v24.0.0). v24.0.0 is running on mainnet ahead of the V24 hard fork, and a handful of fixes that landed on develop since the release should not wait for 24.1: a `test_dash-qt` failure that blocks distribution packagers (#8075), a broken dependency download, a peer-triggerable busy loop, a way for a quorum commitment to be lost for a whole DKG cycle, and a node abort after a reorg.

  It also carries #8131, which changes when masternodes vote NO on superblock triggers. Inside a superblock's maturity window a masternode votes NO on every trigger that doesn't match its candidate and never revisits that vote. If the approved set changes while triggers are being created, masternodes can end up having voted NO on the trigger that matches their final candidate, and the superblock can go unpaid. With #8131 a masternode waits for a trigger matching its own candidate before it votes NO on the others (until 3 blocks before the superblock), and clears the per-cycle "voted YES" marker by height so an unfunded cycle doesn't carry over into the next one. This was a separate PR (#8132) until #8131 merged on develop; it is folded in here so the release branch gets one backport PR.

  It also carries the fixes for the `llmq_400_85` DKG rounds that have been failing on mainnet, which is what the stalled v24 activation is waiting on: #8135, which stops DKG members from reloading every verification vector at commit time, the reason slow members have been missing the commit phase of `llmq_400_85` rounds, and #8130, which makes a member relay its own DKG messages before it works through queued peer messages.

  ## What was done?

  ### Picked

  All eleven are picked from their develop merge commits with `git cherry-pick -m1 -x`. Each pick changes the same lines as its develop counterpart except where noted.

  - #8088 fix: fetch miniupnpc sources from miniupnp.free.fr
  - #8052 fix(qt): reserve the same shared masternode contribution again after a release
  - #8094 fix(net): stop busy-looping while a peer's send buffer is full
  - #8080 test(qt): stop address book tests from answering the shared masternode wizard's prompt (fixes #8075)
  - #8104 fix: keep final commitments mineable when their block is rejected, with the adaptation below
  - #8100 fix: don't abort in governance when a reorg changes masternode internal ids, with the adaptation below
  - #8099 fix(rest): don't terminate on blocks with undecodable ProTx payloads
  - #8135 perf: keep verified DKG contributions cached through the commit phase, with the adaptation below
  - #8130 fix: process a node's own DKG messages ahead of queued peer messages
  - #8097 fix: keep governance triggers across a restart on test networks, source change only (see below)
  - #8131 fix: wait for a matching superblock trigger before voting NO on the others

  ### Adaptations

  - **#8104:** `v24.0.x` doesn't have #7936 (parse each quorum commitment payload once per block). `src/llmq/blockprocessor.cpp` keeps the `v24.0.x` `GetCommitmentsFromBlock` and adds the new `RemoveMineableCommitmentsForBlock()` unchanged; in `blockprocessor.h` its lock annotation drops `!m_commitment_payload_mutex`, a mutex that only exists with #7936. `Chainstate` has no `m_special_tx` member on `v24.0.x`, so the two new calls in `validation.cpp` go through `m_chain_helper->special_tx`, like the neighbouring special-transaction calls. The `specialtxman.*` hunks are identical to the develop merge.
  - **#8135:** in `CDKGSessionManager::CleanupCache`, `v24.0.x` still has a hand-written erase loop that develop had already replaced with `std::erase_if`; the pick takes the new `std::erase_if` form. The benchmark added in `src/bench/bls_dkg.cpp` is left out: it conflicts with the `v24.0.x` version of that file and isn't needed on the release branch. The rest of the source change is identical.
  - **#8097:** only the source change is picked (two lines in `src/governance/governance.cpp`). It is needed for #8131's test: without it a masternode restarted inside the maturity window drops its stored triggers on regtest, testnet and devnets and then rejects the superblock, which is what the restart case of that test does. Mainnet is not affected by that bug, because the expiry check involved is skipped there. #8097's own `feature_governance.py` step is left out because it restarts the pruned node added with #7860, which `v24.0.x` doesn't have.
  - **#8131:** no conflicts; `src/governance/signing.cpp` on `v24.0.x` is identical to develop before the change.
  - **#8100:** the test fixture in `src/test/governance_vote_processing_tests.cpp` keeps `CBaseChainParams::REGTEST`, since `v24.0.x` predates `ChainType`. The source change is identical.

  ### Not picked

  - #8129 (re-sign a pending EHF signal on every block): an earlier revision of this PR carried it. It is still under discussion on develop, and v24.0.1 goes ahead without it: the EHF signal is attempted again when a newly formed quorum is selected for it, which the DKG fixes here are meant to make possible.
  - #8101 (reject InstantSend locks with a noncanonical version or cycle hash): an earlier revision of this PR carried it. It scores a peer 100 for relaying a lock with a non-current version, but nodes without the change accept and relay such a lock, so in a mixed network an upgraded node would discourage honest peers that are still on v24.0.0. It needs to stop scoring that case before it ships anywhere.
  - #8095 and its follow-up #8121 (block templates while the best ChainLock is above the tip): with both, a node refuses to build a template in that window, which is what v24.0.0 already does with a less helpful error. An earlier revision of this PR carried #8095 alone; it was dropped once #8121 merged.
  - #8102 (quorum scan cache): written on top of the #7956 refactor; it needs a hand-port to two functions on `v24.0.x`.
  - #8116 and #7815 (CoinJoin coordinator): long-standing, mixing only; #8116's test depends on #7815.
  - #8085, #8096, #8098, #8103, and the features, refactors, Bitcoin Core backports, CI and test-only changes merged since the branch point.

  ## How Has This Been Tested?

  macOS arm64, depends build with `--enable-debug --enable-werror`, no GUI. The current head is 78ad074.

  On the current head:

  - `dashd` and `test_dash` build cleanly.
  - Unit suites `governance*`, `llmq*`, `dkg*`, `evo*` and `versionbits*` pass, on the relic-based BLS library this branch uses.
  - `feature_governance_trigger_voting.py`, `feature_governance.py`, `feature_governance_cl.py`, `feature_governance_objects.py`, `feature_llmq_dkgerrors.py`, `feature_mnehf.py` and `interface_rest.py` pass.

  On earlier revisions of this branch. The current head has the same content as those revisions for the picks concerned; since then #8129 was dropped (one line in `src/llmq/ehf_signals.cpp` plus its test changes), the #8097 and #8131 picks were added, and the later picks were redone from their develop merge commits without changing the tree:

  - `feature_llmq_signing.py` (both variants), `feature_llmq_chainlocks.py` and `feature_llmq_rotation.py` pass (on the revision without #8097 and #8131).
  - Without the #8097 source change, `feature_governance_trigger_voting.py` fails in its restart case: the restarted masternode rejects the superblock with `bad-cb-amount`.
  - Unit suites `bls*` pass. On a revision that also carried #8095 and #8101, `coinjoin*`, `net_tests`, `miner_tests` and `validation*` passed as well.
  - The full functional suite (`test_runner.py -j16`), on the revision that still carried #8129 and not yet #8097 and #8131: 307 passed, 17 skipped, 1 failed. The skipped ones are the usual environment-dependent tests (`*_bind*`, `interface_usdt_*`, `interface_zmq*`, previous-release compatibility and `feature_unsupported_utxo_db.py`). The run includes `feature_llmq_dkgerrors.py` with #8104's new scenario and `interface_rest.py` with #8099's.
  - The failure was `feature_llmq_signing.py`, in its first `mine_quorum`, waiting for every member to have received all contributions. The node logs show one masternode relaying its contribution about 0.2 s before its connections to the other members had been authenticated, so no peer received it. That happens before anything #8135 or #8130 changes, and it is load-dependent: running four copies of the test in both variants at `-j8`, three times, 2 of 24 runs fail on that revision and 2 of 24 fail on the same branch without the two DKG commits, with the same assertion.
  - A full functional run with the #8097 and #8131 changes on top of an older revision of this branch: 310 passed, 17 skipped, none failed.

  #8131 describes its scenarios and how each was shown to fail without the change.

  The GUI picks (#8052, #8080) were not built or run locally; CI covers them. The first push of this branch did not compile (`m_special_tx`, see Adaptations); review caught it and it was fixed before any of the above was run.

  ## Breaking Changes

  None. Behaviour change for masternodes (#8131): a NO vote on a non-matching trigger may be cast later than before, when the masternode's own candidate has no trigger yet, and at the latest 3 blocks before the superblock.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [x] I have assigned this pull request to a milestone _(if you have permission to set one)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Top commit has no ACKs.

Tree-SHA512: 8ce635d02dd2b9b285aa6a1630d329ffeb9dcb99947a7a758c80ed17a2dbeb7496162a7f3052e872f46d481c6e6391ce866fd296d3ef1fa8edb1dc2d2c5f275e