Disconnect two-way peg data at the connecting block height

[1440000bytes]

disconnect_two_way_peg_data asserted that the most recent deposit_blocks record, withdrawal_bundle_event_blocks record and pending withdrawal-bundle status were stamped at block_height - 1 and gated the pending-bundle removal on block_height - last_failure > WITHDRAWAL_BUNDLE_FAILURE_GAP.

connect_two_way_peg_data stamps all of these at block_height and every other status assertion in disconnect already uses block_height. connect and disconnect of the same block run at the same height (connect_prevalidated_block bumps the height before connect_two_way_peg_data and disconnect_two_way_peg_data runs before disconnect_tip reverts it), so the block_height - 1 checks never matched.

As a result, disconnecting a sidechain block that applied a mainchain deposit or withdrawal-bundle event on a reorg panicked on the assertion and a pending bundle created by that block was never removed. This wedges a node on any mainchain reorg that orphans such a block. The off-by-one also underflowed at height 0.

Align the four checks with connect (block_height, >=). This also matches the existing disconnect status assertions. Add a regression test that connects a deposit and disconnects it through the real connect/disconnect paths.

---

Fuzzing logs

Assertion failure (reorg of a deposit block at height >= 1):

#48  NEW  cov: 871 ft: 1344 corp: 7/14b lim: 4 exec/s: 0 rss: 91Mb
thread '<unnamed>' panicked at lib/state/two_way_peg_data.rs:1097:20:
assertion `left == right` failed
  left: 0
 right: 1
==97316== ERROR: libFuzzer: deadly signal
SUMMARY: libFuzzer: deadly signal

Underflow variant (deposit in the first block, height 0), minimized input [65, 6, 10, 93]:

Running: fuzz/artifacts/twpd_reorg/crash-d4bd2cd642d9180ad4919e39be30c6efbc7cd8e7
thread '<unnamed>' panicked at lib/state/two_way_peg_data.rs:1097:20:
attempt to subtract with overflow
==97405== ERROR: libFuzzer: deadly signal
SUMMARY: libFuzzer: deadly signal
artifact_prefix='.../artifacts/twpd_reorg/';
Test unit written to .../crash-d4bd2cd642d9180ad4919e39be30c6efbc7cd8e7
Base64: QQYKXQ==

[Ash-L2L]

LGTM!