splice: add zero-conf splice support per BOLT #2

When option_zeroconf is negotiated on a channel, send splice_locked
immediately at depth 0 instead of waiting for confirmations. Also
prohibit tx_init_rbf on zero-conf channels since RBF would double-spend
the unconfirmed funding output.

This implements the spec requirements from lightning/bolts#1160:
- splice_depth_cb: allow depth==0 through for minimum_depth==0 channels
- handle_splice_stfu_success: block RBF initiation on zero-conf
- splice_acceptor: reject incoming tx_init_rbf on zero-conf

Changelog-Added: splice: Support zero-conf splicing on channels with option_zeroconf negotiated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: vincenzopalazzo

channeld/channeld.c

@@ -4099,6 +4099,16 @@ static void splice_accepter(struct peer *peer, const u8 *inmsg)
 		}
 	}
 	else if (type == WIRE_TX_INIT_RBF) {
+		/* BOLT #2:
+		 * The sender:
+		 *   - MUST NOT send `tx_init_rbf` if `option_zeroconf`
+		 *     has been negotiated.
+		 */
+		if (channel_type_has(peer->channel->type, OPT_ZEROCONF))
+			peer_failed_warn(peer->pps, &peer->channel_id,
+					 "Peer sent tx_init_rbf but channel"
+					 " uses option_zeroconf");
+
 		if (!fromwire_tx_init_rbf(tmpctx, inmsg,
 					  &channel_id,
 					  &locktime,
@@ -4793,6 +4803,16 @@ static void handle_splice_stfu_success(struct peer *peer)
 				    &peer->channel->funding_pubkey[LOCAL]);
 	}
 	else { /* RBF attempt */
+		/* BOLT #2:
+		 * The sender:
+		 *   - MUST NOT send `tx_init_rbf` if `option_zeroconf`
+		 *     has been negotiated.
+		 */
+		if (channel_type_has(peer->channel->type, OPT_ZEROCONF))
+			peer_failed_warn(peer->pps, &peer->channel_id,
+					 "Cannot RBF splice: channel uses"
+					 " option_zeroconf");
+
 		init_rbf_tlvs = tlv_tx_init_rbf_tlvs_new(tmpctx);
 		init_rbf_tlvs->funding_output_contribution = tal(init_rbf_tlvs, s64);
 		*init_rbf_tlvs->funding_output_contribution = peer->splicing->opener_relative;

lightningd/channel_control.c

@@ -685,8 +685,10 @@ static enum watch_result splice_depth_cb(struct lightningd *ld,
 		return DELETE_WATCH;
 	}
 
-	/* Reorged out?  OK, we're not committed yet. */
-	if (depth == 0) {
+	/* Reorged out?  OK, we're not committed yet.
+	 * But for zero-conf channels (minimum_depth == 0), depth 0 means
+	 * we should send splice_locked immediately per BOLT #2. */
+	if (depth == 0 && inflight->channel->minimum_depth != 0) {
 		return KEEP_WATCHING;
 	}