Suggested by @darosior in #35835.
FindAndDelete only matches whole pushes at opcode boundaries, so a push that carries the signature inside its data is left in the scriptCode. btcd (<0.24.2) removed any push containing the signature, computed a different sighash, and would have rejected a transaction Core accepts: the chain split in CVE-2024-38365.
The rule is already covered from the failure side, in script_FindAndDelete and in the tx_invalid.json vectors where the signature sits under a non-standard pushdata prefix. What was missing is the positive direction: a transaction Core must accept because nothing is deleted.
This adds one vector to tx_valid.json, with OP_CHECKSIGVERIFY <0xaaaa||sig> as the P2SH redeemScript and the minimal 8-byte DER signature (r = s = 1). The pubkey is recovered from that signature and the sighash Core computes, so it verifies only if the <0xaaaa||sig> push survives into the scriptCode. CONST_SCRIPTCODE doesn't fire — FindAndDelete finds nothing — and the vector runs with every flag.
To check it actually discriminates, I patched EvalChecksigPreTapscript to drop any push whose data contains the signature, the way btcd did. The vector fails with that patch and passes without it.
Tested with:
build/bin/test_bitcoin --run_test=transaction_tests
