Summary

Follow up to #9485, which fixed truncated Bitcoin blocks. The same kind of bad block still crashed the Elements/Liquid header parser:

• The challenge and dynafed fields were hashed before pull() checked the length. A truncated header caused a heap over-read, then a NULL dereference (sha256_update(shactx, NULL, 4))
• A zero-length pull() after an earlier failure hit assert(p)
• The extension-space and signblock witness counts come straight from the block, so a bad varint could loop up to 2^64 times

Separately, for all chains, a huge tx count made tal_arr() overflow and abort
As in #9485, this needs the chain backend to serve a bad block. A peer cannot trigger it

Fix

• Add pull_and_hash(), which hashes only the bytes that pull() returns, and use it for all hashed header fields
• Make pull() fail cleanly when the cursor is already NULL
• Stop the two count-driven loops once the data runs out
• Reject a tx count larger than the remaining bytes

Testing

run-bitcoin_block_from_hex now builds small liquid-regtest blocks (with and without dynafed) and checks that each one parses and that every truncation of it is rejected. It also checks huge extension space, signblock-witness and tx counts. Disabling any single part of the fix makes the test abort, segfault or hang

Checklist

Before submitting the PR, ensure the following tasks are completed. If an item is not applicable to your PR, please mark it as checked:

• The changelog has been updated in the relevant commit(s) according to the guidelines.
• Tests have been added or modified to reflect the changes.
• Documentation has been reviewed and updated as needed.
• Related issues have been listed and linked, including any that this PR closes.
• Important All PRs must consider how to reverse any persistent changes for tools/lightning-downgrade