fix(tss): select fund migration signers from the old key's shareholders

[Aman035]

Fund migration signs with the old key's shares, but the coordinator picked signers the same way it does for an outbound: a random threshold subset of the current Active + PendingLeave set.

A newcomer picked that way has no share of the old key. It fails to load the keyshare, never ACKs, and the session stalls. Once fewer than a current-set threshold of old shareholders remain, no draw can succeed and the migration is stuck for good.

Fix

• Fund migration signers are drawn from the old key's on-chain participant list, intersected with validators still eligible to sign.
• Required count is the old key's threshold, not the current set's.
• Too few surviving shareholders logs and skips instead of dispatching a set that can never reach quorum.
• Selection moved into selectParticipants, so the per-protocol routing is testable.

Tests

• Old key of 3, current set of 10: only the 3 are ever picked, over 200 draws.
• 6 shareholders among 11 validators: every signer holds a share, count is the old key's threshold.
• 4 of 6 shareholders left: fails closed rather than returning a short set.
• Pending leave still signs; inactive does not.
• Malformed data, empty key id, unknown key, empty participants, lookup failure.
• 11 mutations applied, all caught. Clean under the race detector.