Suggested by @darosior in #35835.
FindAndDelete only matches whole pushes at opcode boundaries, so a push that carries the signature inside its data is left in the scriptCode. btcd (<0.24.2) removed any push containing the signature, computed a different sighash, and would have rejected a transaction Core accepts: the chain split described in CVE-2024-38365.
We already cover the rule from the failure side: script_FindAndDelete has the "doesn't match 'inside' opcodes" cases, and tx_invalid.json has the vectors where the signature is duplicated under a non-standard pushdata prefix. What was missing is the positive direction, a transaction Core must accept because nothing is deleted.
This adds one vector to tx_valid.json. The P2SH redeemScript is OP_CHECKSIGVERIFY <0xaaaa||sig>, spent with <sig> <pubkey> <redeemScript>, using the minimal 8-byte DER signature (r = s = 1). The pubkey is recovered from that signature and the sighash Core computes, so the signature verifies only if the <0xaaaa||sig> push survives into the scriptCode. Note that CONST_SCRIPTCODE doesn't fire here: FindAndDelete finds nothing, and the vector holds with every flag applied.
To check the vector actually discriminates, I patched EvalChecksigPreTapscript to drop any push whose data contains the signature, the way btcd did. The vector fails with that patch applied and passes without it.
Tested with:
cmake --build build --target test_bitcoin
build/bin/test_bitcoin --run_test=transaction_tests
