test: F-2026-18199 | [Dual Defense] TSS Setup Message Signs an Unverified Hash (Payload vs SigningHash Split)

[Aman035]

F-2026-18199 follow-up: pin setup decoding across all protocols

Landed after #309 merged. No behaviour change beyond one widened check.

Why

• setupBindsThreshold runs on quorumchange, which is built by DklsQcSetupMsgNew, a different constructor from keygen. Merged code exercised that path only in production, never in a test.
• The DKLS library is built locally, so a rebuild that changes the setup encoding would break quorum change silently.

What I did

• Added TestSetupDecoders_AllProtocols, a matrix over the three setup shapes the coordinator builds: keygen (shared with keyrefresh), quorumchange, and sign (shared with fund migration).
• For each shape it pins what all three decoders return, so a format change fails in CI rather than in production.
• Widened SetupThreshold to accept a u16 threshold as well as u8. The weighted keygen variant stores it as u16 under the same tag, and the merged code would reject every setup rather than read it.

Behaviour the matrix pins

• Participants decode for all three shapes, since that binding applies to every protocol.
• Threshold decodes for keygen and quorumchange, and errors for sign. Sign setups carry no threshold, and erroring is what stops a bogus value being read out of unrelated bytes.
• Message hash decodes for sign, and is empty for the others, so a non-sign setup can never satisfy the hash binding.