feat(utxo-core): PayGo Attestation util functions

[davidkaplanbitgo]

TICKET: BTC-2047

[davidkaplanbitgo]

Good start!

[davidkaplanbitgo]

Looking good!

[Copilot]

Pull Request Overview

Adds PayGo attestation support for PSBTs and updates Zcash address assertions.

• Replace assert(...) with assert.ok(...) for Zcash address functions
• Introduce PAYGO_ADDRESS_ATTESTATION_PROOF subtype and implement PayGo PSBT utilities and tests
• Export new PSBT utilities and add bitcoinjs-message dependency

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
modules/utxo-lib/src/bitgo/zcash/address.ts	Switched to assert.ok(isZcash(network)) for outputScript/address validation
modules/utxo-lib/src/bitgo/PsbtUtil.ts	Added PAYGO_ADDRESS_ATTESTATION_PROOF = 0x04 to ProprietaryKeySubtype
modules/utxo-core/src/paygo/psbt/PayGoUtils.ts	Implemented addPaygoAddressProof, verifyPaygoAddressProof, index lookup, and inclusion check
modules/utxo-core/test/paygo/psbt/PayGoUtils.ts	Added unit tests covering PayGo attestation proof addition, verification, and error cases
modules/utxo-core/src/paygo/index.ts	Exported PSBT utilities
modules/utxo-core/package.json	Added bitcoinjs-message dependency

Comments suppressed due to low confidence (3)

modules/utxo-core/src/paygo/psbt/PayGoUtils.ts:36

• [nitpick] Update the JSDoc for verifyPaygoAddressProof to match the actual signature: swap @param pub and @param message, and rename pub to attestationPubKey to align with the code.

@param pub - The public key that we want to verify the proof with

modules/utxo-core/test/paygo/psbt/PayGoUtils.ts:70

• [nitpick] Add a test case where the PSBT contains a mismatched public key to ensure verifyPaygoAddressProof throws the expected 'The public key in the PSBT does not match the provided public key.' error.

it("should fail a proof verification if the proof isn't valid", () => {

modules/utxo-core/test/paygo/psbt/PayGoUtils.ts:117

• [nitpick] The describe title uses 'getPaygoAddressProofIndex' but the function is named getPaygoAddressProofOutputIndex. Update the test title for clarity and consistency.

describe('getPaygoAddressProofIndex', () => {