TaprootSignatureMsg defaults codeseparator_pos to -1 and serializes it with .to_bytes(4, "little", signed=False), so any scriptpath=True call that relies on the default raises OverflowError.
The unsigned encoding was added so callers could pass 0xfffffffe/0xffffffff, and the call sites in feature_taproot.py were updated to default to 0xffffffff; this default was left at -1. The only in-tree scriptpath caller passes codeseparator_pos explicitly, so CI does not hit it.
Set the default to 0xFFFFFFFF: the value feature_taproot.py uses for "no codeseparator", and the bytes the previous signed encoding produced for -1.