channeld: report the fundee's full post-splice balance to hsmd in msat

[Amperstrand]

relative_splice_balance_fundee() computes the push_value handed to hsmd via hsmd_setup_channel when a splice creates a new channel era. It is wrong three ways:

1. Units: it wrapped the satoshi-denominated opener_relative/accepter_relative splicing fields in amount_msat() unchanged, so the value reached hsmd 1000x under-reported.
2. Role: the contribution was selected by splice role, but the fundee is defined by channel role: the side that did not open the channel. The splice initiator is not necessarily the channel opener, so whenever the channel fundee reports -- whether it initiated the splice or accepted an opener-initiated one -- the splice roles are inverted with respect to the channel roles and the channel opener's contribution was sent instead of the fundee's.
3. Prior balance: push_value is the fundee's balance at the start of a channel era (at channel open, the pushed amount); for a splice that is pre-splice balance + funding contribution. A fundee already holding balance was under-reported by exactly that balance -- and a fundee holding HTLCs in flight at splice setup was under-reported by those too: a fundee-owned HTLC that fails back raises the fundee's output above its settled at-setup balance.

None of this is caught by the existing tests: stock hsmd signs unconditionally, so no test observes what hsmd was told.

Impact: stock hsmd is unaffected (it signs whatever it is asked to); any hsmd/signer implementation that validates the balances reported to it reads the honest post-splice commitment as an overpayment and refuses to sign it, wedging fundee-side splices. Found while running a validating signer implementation against experimental splicing.

Fix: three commits, each independently test-covered. Units conversion (amount_sat_to_msat, matching every other consumer of these fields, which feed amount_msat_add_sat_s64); then selection by channel opener role plus the fundee's pre-splice settled balance from the channel view (view[].owed[]); then the fundee-owned HTLCs pending at splice setup (bucketed by owner side, the same bucketing check_balances uses; the other side's HTLCs never count). A negative contribution is a splice-out and subtracts; a negative total or an overflowing add is a genuine over-draw and fails the peer. Nothing is ever wrapped or clamped.

Tests: channeld/test/run-splice_fundee_msat.c pins byte-exact through the real static function: the channel/splice role matrix, X-sat -> X*1000 msat (never X msat: the wrap fingerprint), pre-splice balance, splice-out and pending-HTLC cases (fundee-owned HTLCs included, other side's excluded), and refusal of out-of-range and cushioned true-negative totals. It follows the hsmd/test/run-bad-request-close.c pattern of including the daemon .c (with its main renamed) to unit-test statics; channeld had no unit-test home that could otherwise reach this function. test_splice_fundee_with_balance exercises a splice on top of a fundee that already holds 500k sat; the rest of tests/test_splicing.py (25 tests) passes unchanged with stock hsmd.