Support multiple payment outputs on claim and refund transactions

[BullishNode]

What

Adds the ability to pay multiple outputs from a swap claim or refund transaction, on both Liquid and Bitcoin.

• LBtcSwapTx / BtcSwapTx gain additional_outputs: Vec<(Address, u64)> and a with_additional_outputs(...) setter.
• The primary output_address receives the remainder (input − fee − Σ additional) and remains the first payment output (index 0 on claims; after the fee output on Liquid refunds, matching the existing refund output order). Additional outputs pay fixed amounts in the given order.
• TransactionOptions::with_additional_outputs(Vec<(String, u64)>) threads the destinations through construct_claim / construct_refund on both chains without breaking existing callers (new private field with Default).

Validation policy

Construction enforces balance, not policy:

• Additional amounts are summed with checked_add (a wrapping sum cannot bypass the insufficient-funds guard) and must fit in input − fee.
• Bitcoin accepts zero-valued outputs and a zero primary remainder: zero outputs are consensus-valid, and dust/relay policy belongs to the broadcaster, not the constructor.
• Liquid rejects zero-valued outputs — including a zero primary — up front with a clear protocol error: every payment output is confidential and the rangeproof cannot prove less than 1 satoshi (TxOut::RANGEPROOF_MIN_VALUE).
• The wrapper conversions validate address strings before any signing: network match on Bitcoin (also fixes a pre-existing bug where new_claim_with_utxo computed but discarded its network check), address params + confidentiality on Liquid.

Liquid CT details

create_claim/create_refund share a create_payment_outputs helper generalized to N blinded outputs:

• each output gets its own asset blinding factor, surjection proof and rangeproof;
• the last payment output balances the blinding equation via ValueBlindingFactor::last against the input and the explicit fee output;
• for a single output the arguments are identical to the previous code, so existing behavior is unchanged.

The cooperative (MuSig key-path) flows are untouched: they already sign whatever transaction was built and send the full serialized tx to Boltz for the partial signature, which commits to all outputs.

Tests

• Unit tests fabricate a blinded funding utxo locally (no chain backend): multi-output Liquid claim and refund pass verify_tx_amt_proofs and every output unblinds to the expected value/asset/script_pubkey; boundary cases cover zero, one-satoshi, [u64::MAX, 1] overflow, zero-primary, insufficient funds and unblinded addresses on the appropriate chain.
• Node-level broadcast tests (tests/txs.rs): multi-output claims and refunds on both chains are broadcast to elementsd/bitcoind and accepted, including a Bitcoin multi-output claim with Fee::Relative proving the added output weight is paid for.
• Boltz regtest suite exercises the wrapper path end to end: reverse claims run a non-cooperative multi-output variant; submarine refunds and chain-swap claims pass additional outputs cooperatively, so Boltz partial-signs complete multi-output transactions on both chains. A shared helper asserts remainder math, output ordering, and unblinds Liquid outputs via the node's blinding keys.
• Mainnet battle tests against production Boltz (harness in examples/multiout_battletest.rs), all claimed cooperatively:
  • reverse swap ZqxQ58hMEIxY → Liquid claim 0e845207… (2 blinded outputs + explicit fee, confirmed)
  • chain swap L-BTC→BTC FkNCgU6FJzfA → Bitcoin claim 7266da85… (24,343 + 5,000 sat outputs)
  • chain swap BTC→L-BTC 5RHJIphzQrkN → Liquid claim 24a88229…

All of cargo fmt --check, make cargo-clippy, make wasm-clippy, make cargo-test (73 passed), make wasm-test, make cargo-regtest-test (13/13 flows) and make wasm-regtest-test (7/7) pass.

Compatibility notes

• Must ship as 0.5.0 (changelog section included; version bump left to the release PR). Adding the struct field is source-breaking for code constructing LBtcSwapTx/BtcSwapTx with literal syntax; constructors initialize it to an empty vector and the wrapper API is backward compatible.
• Bitcoin single-output behavior with input == fee (zero primary) is unchanged; Liquid previously failed the same case deep inside blinding and now fails it with a clear protocol error.
• The insufficient-funds error strings changed slightly (they now mention additional outputs).
• FFI bindings (UniFFI/Python/Dart) intentionally do not expose additional_outputs yet — follow-up work.