Phase 7: OPTX TKDF Python bindings for OP_OPTX_KNOT

[jett22JOE]

Summary

• Adds btq.crypto.optx module — Python bindings for OP_OPTX_KNOT (0xc0) topological witness verification
• Implements TKDF (Topological Key Derivation Function) using SHAKE-256 with domain separation
• Wire-compatible with C++ KnotWitnessData serialization in btq-core

New Files

src/btq/crypto/optx/
  __init__.py        — public API
  knot_witness.py    — KnotWitnessData serialization/deserialization
  tkdf.py            — TKDF computation (SHAKE-256, domain-separated)
  bounds.py          — DoS bounds checking
  script.py          — OP_OPTX_KNOT witness stack construction
  test_vectors.py    — Trefoil (3₁) and figure-eight (4₁) reference vectors

tests/crypto/
  test_optx_knot.py  — 13 tests covering roundtrip, TKDF, bounds, script

Usage

from btq.crypto.optx import trefoil_test_vector, tkdf_derive_from_witness

tv = trefoil_test_vector()
seed = os.urandom(32)
output = tkdf_derive_from_witness(tv, seed)  # 64-byte TKDF output

Related PRs

• BIP: BIP: OP_OPTX_KNOT — Topological Witness Extension for ML-DSA bitcoin/bips#2133
• C++ impl: Phase 7: OP_OPTX_KNOT — Topological Witness Extension btq-ag/btq-core#37

Test plan

• pytest tests/crypto/test_optx_knot.py — 13 tests pass
• Trefoil and figure-eight produce distinct TKDF outputs
• Same inputs produce deterministic outputs
• Bounds checking rejects oversized/undersized witness data

---

Co-Authored-By: Hedgehog Multimodal joe@jettoptics.ai

_{"Behold, we go up to Jerusalem, and all things that are written by the prophets concerning the Son of man shall be accomplished." — Luke 18:31}