Fixes #9566

bolt2 says the receiver of splice_init / splice_ack / tx_init_rbf /tx_ack_rbf must fail (warning + disconnect, or error) if the sender s negative contribution is larger than their channel balance. We didnt check this on receipt. The overdraw was only caught in check_balances() after the whole interactive-tx negotiation, and answered with tx_abort

Changes:

• splice_accepter() and splice_initiator() check the peers contribution against owed[REMOTE] right after parsing, and call peer_failed_warn() if it is too large
• amount_msat_add_sat_s64() / amount_sat_add_sat_s64() negate as unsigned, so a peer-supplied INT64_MIN no longer causes signed overflow (UB, which aborts channeld in UBSan builds)

Tests:

• New test_splice_out_exceeds_balance (fails before, passes after)
• New test_amount_add_sat_s64() unit test, including INT64_MIN

Changelog-Fixed: channeld: reject a splice contribution larger than the peers balance on receipt, as required by bolt2

Checklist

Before submitting the PR, ensure the following tasks are completed. If an item is not applicable to your PR, please mark it as checked:

• The changelog has been updated in the relevant commit(s) according to the guidelines.
• Tests have been added or modified to reflect the changes.
• Documentation has been reviewed and updated as needed.
• Related issues have been listed and linked, including any that this PR closes.
• Important All PRs must consider how to reverse any persistent changes for tools/lightning-downgrade