[KSlashh]

Depends on #527. Review against audit/29-force-skip-committee; merge the parent first, then retarget this PR to dev. goat is copied from GOATNetwork/BitVM gc-v2 at 2c76a2c, the head of GOATNetwork/BitVM#23, so it already contains the M29 connector change. After this lands, Cargo no longer points at a BitVM PR branch.

goat (the transaction graph, connectors and scripts) had no user other than this node, and every change to it needed a BitVM PR plus a Cargo branch switch here. The bitvm crate (BitVM's script and signature library) now comes from upstream BitVM/BitVM, pinned to one commit that node and GOATNetwork/bitvm-gc share. Nothing depends on GOATNetwork/BitVM any more.

Commits, each reviewable on its own:

1. Move: crates/goat/src is byte-identical to goat/src at 2c76a2c (check with diff -r). The manifest keeps the dependency specs the BitVM workspace gave goat, and the lockfile only swaps goat's git source for the path. MIT license file included.
2. Format with the workspace rustfmt config. Formatting only.
3. Clippy under the workspace -D warnings: &Vec parameters become slices, one saturating_sub, #[allow(clippy::too_many_arguments)] on three constructors, two test arrays. Callers are unchanged apart from one bitvm-gc test.
4. Dead code: drop proof, common, serialization and the tx-sender binary, none of which is used. The groth16 proof tests read files that do not exist. goat's dependencies go from 36 to 14.
5. One bitvm: node used bitvm from branch gc-v2 and bitvm-gc from branch GA, so Cargo built it twice. bitvm/ is identical on both branches. Node and bitvm-gc (refactor: pin BitVM to a shared commit bitvm-gc#61) now both use rev = "26b0bd61b61b24b50b2d2443a7fda8e58412edfa" (GA), and node pins bitvm-gc by rev as well. The fmt job fails if Cargo.lock holds more than one bitvm.
6. Upstream bitvm: node and bitvm-gc (refactor: pin BitVM to a shared commit bitvm-gc#61) move to BitVM/BitVM rev = "c620dbfaacebdf778e765a6681985350389973b1" (main, 2026-10-21). GOATNetwork/BitVM's own changes to bitvm/ are all in chunk/ (the groth16 verifier: NUM_PUBS = 2, the *_lit helpers), which nothing here uses. The modules we use (signatures, hash::blake3, execute_script, treepp, RawWitness) are identical to GA apart from a re-enabled test. Upstream's one functional change since, the zero-bit lshift_prevent_overflow, is called only from bn254. So scripts, WOTS encoding and connector addresses do not change.

Review notes

• goat used to enable reqwest 0.11's default features, which makes native-tls (OS trust store) the TLS backend of esplora-client. crates/client now declares the same reqwest 0.11 features so the backend does not change. With that pin, the node binary's resolved features are identical before and after, apart from the unused toml 0.5. proof-builder-rpc gains only reqwest's blocking module, which it does not call.
• goat stays on edition 2021.
• Once this merges, goat changes go here and BitVM gc-v2 can be frozen.
• Merge refactor: pin BitVM to a shared commit bitvm-gc#61 first. Node pins its branch commit 8e9a7ac, which stays fetchable after a merge commit or fast-forward. After a squash merge, re-pin to the commit on main.
• To move bitvm later, change the rev in both repos together. The CI check catches a mismatch.

Tests: goat's 13 tests now run in node CI. bitvm-gc, node tests, workspace clippy with -D warnings and fmt pass. The node binaries' resolved features are identical before and after the bitvm pin and the upstream switch. bitvm-gc: verifiable-circuit-babe and soldering-host build against upstream bitvm, and its WOTS tests pass.

Validation results above are recorded in the zkm PR notes. The final dependency URLs and revisions were checked against the current PR head; builds and tests were not rerun during this description update.