feat(zcash): sign transparent outbounds as v6 (ZIP-229)

Itzamnarequested to merge
itz/zcash-v6-nu63 into develop

What

Bifrost's zcash signer builds transparent outbounds as v6 (ZIP-229) instead of v5.

  • Build path: redeemTx.Version = 6.
  • Resume path accepts v5 or v6; the version is pinned in the checkpoint bytes, so an in-flight v5 checkpoint finishes as v5.
  • Consensus branch id stays daemon-derived (ZecConsensusBranchID), no hardcoded activation height.

Why

v5 was the safe default while v6 was not yet valid. NU6.3 (block 3,428,143) made v6 valid and the standard format on mainnet; ZIP-230 is withdrawn and v6 is defined by ZIP-229.

Rollout precondition

v5 and v6 produce different ZIP-244 keysign digests, so a mixed v5/v6 signer set cannot form a party. This is safe while HALTSIGNINGZEC=1 holds until every bifrost runs this build; unhalt only after. Mainnet ZEC is currently halted and has never signed a production tx. Verify HALTSIGNINGZEC on stagenet before deploying there.

Validation

  • Simulation signer already builds v6 against an NU6.3-activated mocknet zebrad in CI.
  • utxo/ and zcash/ packages green; added v6 broadcast and rejection coverage.

Merge request reports