test: add CONST_SCRIPTCODE failure-path vectors to script_tests.json #35835

Follow-up to #35664.

Going through which script error codes script_tests.json covers, I found that neither error gated behind SCRIPT_VERIFY_CONST_SCRIPTCODE is asserted anywhere. SCRIPT_ERR_SIG_FINDANDDELETE is not asserted by any test; SCRIPT_ERR_OP_CODESEPARATOR appears only as a mempool reject string in invalid_txs.py, never at the script level. tx_invalid.json does have a CONST_SCRIPTCODE section, but those vectors can only say a transaction is invalid, not which error made it fail; script_tests.json is the harness that pins error codes, and it has no vector using the flag.

This adds six vectors. Four fail with the flag set:

• OP_CODESEPARATOR in an executed pre-segwit script.
• OP_CODESEPARATOR in an unexecuted IF branch. The check in EvalScript runs ahead of the fExec guard, so the opcode is rejected even though it never executes — the rule with no error-level coverage before.
• A signature push that also appears in the scriptPubKey, against CHECKSIG.
• The same against CHECKMULTISIG, which calls FindAndDelete in a separate loop.

The other two are controls with the flag off, one per error. Both checks run before signature verification, so the vectors can use a dummy signature.

To confirm the expected errors are the ones that fire, I added the vectors expecting OK first and let the harness report the actual error for each.

Tested with:

build/bin/test_bitcoin --run_test=script_tests/script_json_test

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35835.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process.

If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

Concept ACK.

Speaking of const scriptcode quirks, do we have a test case for CVE-2024-38365?

Not with the signature as the suffix of a bigger push, no. And CONST_SCRIPTCODE makes no difference there anyway, since FindAndDelete finds nothing. I'll add one separately.

<!--85328a0da195eb286784d51f73fa0af9-->

🚧 At least one of the CI tasks failed. _{Task riscv32 bare metal, static libbitcoin_consensus: https://github.com/bitcoin/bitcoin/actions/runs/30455919894/job/91974388578} _{LLM reason (✨ experimental): CI failed because submodule fetching hit GitHub rate limiting (HTTP 429 “remote end hung up unexpectedly”), so required commit for newlib/gcc couldn’t be retrieved (exit code 2).}

<details><summary>Hints</summary>

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

• Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

• A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.

• An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

</details>