Enforce witness entry and per-instruction stack limits

[adrienlacombe]

An executor starting with 1,000 items currently accepts a data push followed by OP_DROP, despite the temporary 1,001-item stack. It also accepts oversized initial Tapscript stacks and witness elements when the script consumes them before later checks.

Move the combined main/alt-stack limit check after every instruction, including data pushes and OP_0, and record the peak before rejecting an overflowing step. Before the first instruction, enforce the initial count in Tapscript and the 520-byte element limit in SegwitV0/Tapscript. Disabling enforce_stack_limit still disables only the item-count limit. Preserve the opcode on numeric-push failures.

The context distinction follows Bitcoin Core v30.0, commit d0f6d9953a15d7c7111d46dcb76ab2bb18e5dee3: ExecuteWitnessScript checks initial counts only for Tapscript and element sizes for both witness versions; EvalScript checks combined live depth after instructions. Tests preserve the pre-Tapscript ability to consume an initial excess item before the per-instruction check.

with_stack supplies an artificial execution state, so its replacement main/alt stacks now define the initial peak and undergo the same entry checks, instead of retaining the count of the witness vector used to initialize validation weight.

Validation:

• Against original upstream ba96bc2bd76774c9d1b011461cb79d983c2c43a1, seven of the nine new regression groups fail; the two control groups pass.
• With this patch, cargo test --locked --all-features -- --skip fields:: passes 11 existing unit tests, nine integration tests, and one doctest.
• Tests cover 1,000/1,001 entry counts, 520/521-byte witness elements, all three execution contexts, enabled/disabled count limits, direct/empty/numeric pushes, altstack coexistence, skipped branches, empty scripts, and replacement-state statistics.
• git diff --check and formatting of the new test pass. The existing lifetime warning in src/data_structures.rs is unchanged.

This is a bounded resource-check repair, not a claim of complete Bitcoin Core compatibility. In particular, the existing lack of Tapscript OP_SUCCESSx scanning and its precedence over resource checks remains unchanged, as do experimental OP_CAT defaults and signature-budget behavior.