fix: F-2026-18799 | [Dual Defense] SIGN_FUND_MIGRATE Selects Current Sign Threshold, Not TssKeyHistory Shareholders

[Aman035]

Fund migration signs with the old key's shares, but both sides treated it like an outbound and used the current Active + PendingLeave set.

• Coordinator picked a random threshold subset of the current set. A newcomer picked that way holds no share of the old key, fails to load the keyshare, never ACKs, and the session stalls.
• Participants validated against the current set too, so once the coordinator was fixed alone they would reject its valid selection outright.

Once fewer than a current-set threshold of old shareholders remain, no draw can succeed and the migration is stuck for good.

Fix

• FundMigrateEligible resolves the old key's on-chain participants intersected with validators still eligible to sign, plus the old key's threshold.
• Coordinator selects from it; participants validate against it. Both derive the same answer from chain state.
• Required count is the old key's threshold, not the current set's, and not one derived from the survivors either. Deriving it from survivors would lower the bar every time a shareholder drops out.
• Too few surviving shareholders fails closed on both sides.

Tests

End to end across both components: the coordinator selects, then a participant validates the exact set it produced.

• Old key of 3, current set of 10: only the 3 are ever picked, and validation accepts them. 100 draws.
• 6 shareholders with 5 left: 4 is rejected, 5 accepted, coordinator picks exactly those 5.
• Non-shareholder in an otherwise valid set is rejected.
• Both sides fail closed when shareholders are gone, and on an unresolvable key.
• Outbound round trip unchanged.
• 15 mutations applied, all caught, including leaving the validation side unfixed. Clean under the race detector.