feat: add Lesson 15 prototype flow for CoinJoin

[Av1ralS1ngh]

Lesson 15: CoinJoin Construction — Prototype Flow

Overview

Implements the prototype canvas layout for Lesson 15, in which two participants (Alice and Bob) collaboratively build a CoinJoin transaction using real P2WPKH UTXOs. The lesson's core insight is that CoinJoin privacy is structural, not computational — ambiguity is a direct consequence of placing equal-value outputs on the canvas, not an abstract property explained after the fact.

The flow follows the same entry pattern as Lesson 8 (SegWit Intro), ensuring continuity for students who have completed prior lessons.

---

Stage Progress

Stage	Description	Status
G0 · UTXOs	Alice and Bob each paste their funding TX hex	Wired
G1 · Decomp	Extract 4 fields per participant via extract_tx_field nodes (8 edges total)	Wired
G2 · Equal Outputs	Set denomination (690,000 sats) and place both receive addresses as identity nodes	Layout only
G3 · Signing	Per-participant private key subgraphs with zero cross-wiring enforced by the graph	Layout only
G4 · TX + Verify	16-handle concat_all assembly + script_verification per input	Layout only
G5 · Interpret	Extract output values, confirm equality, explain why CIOH and change-detection heuristics fail	Layout only

---

Design Decisions

• Familiar entry point. G0–G1 mirror the Lesson 8 pattern so returning students have immediate orientation.
• Privacy is visual. Two equal-value nodes on the canvas are the lesson — students can point at them rather than trust an abstract explanation.
• Key isolation is structural. Alice's and Bob's signing subgraphs share zero edges, making the security property inspectable, not assumed.
• Construction precedes interpretation. G5 reads the transaction only after G0–G4 have produced a verified artifact, consistent with Lessons 13 and 14.

---

Out of Scope (Next Iteration)

Full byte-level transaction construction is deferred, including: byte-order conversions, BIP143 sighash computation (hash_prevouts, hash_sequence, hash_outputs), BIP143 preimage assembly, scriptCode construction, ECDSA signing (sign_as_bitcoin_core_low_r), witness assembly, final TX concat_all wiring, script_verification nodes, and G5 compare_equal output validation.

[rawBit-io]

It is hard to assess if grouping makes sense before the full flow is visible. So I can't give you Go on this.
In my experience grouping and story writing is the last part after the complete flow is constructed and requires sometime redesign of nodes to make more simple and compelling story.