fix(bws): bind TSS keygen partyId to the submitting copayer

[SashaMIT]

Summary

TSS sign already binds (copayerId, partyId) before accepting a round message. Keygen only checked whether the party slot was empty.

That let a later submitter use someone else's partyId (or claim a second slot) once the session existed. partyId was also unbounded, so a value >= n skipped the occupancy check.

This adds the same ownership bind: one copayer, one in-range slot.

Test plan

• assertKeygenPartyOwnership covers empty slot, owner resubmit, stolen slot, second slot, and partyId >= n
• Revert-tested: without the bind, a second copayer is accepted on an occupied slot

Made with Cursor