[v26.04.2] segfault in `replay_tx_hash_lock`

```
2026-07-19T05:57:30.644Z **BROKEN** lightningd: FATAL SIGNAL 11 (version 26.04.2-gentoo-r0)
2026-07-19T05:57:30.645Z **BROKEN** lightningd: backtrace: common/daemon.c:83 (crashdump) 0x5574682a81c1
2026-07-19T05:57:30.645Z **BROKEN** lightningd: backtrace: /var/tmp/portage/sys-libs/glibc-2.43-r2/work/glibc-2.43/signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x7f88a6802abf
2026-07-19T05:57:30.645Z **BROKEN** lightningd: backtrace: ccan/ccan/htable/htable.c:145 (htable_lock) 0x5574682dab00
2026-07-19T05:57:30.645Z **BROKEN** lightningd: backtrace: lightningd/onchain_control.c:43 (replay_tx_hash_lock) 0x55746823bfb8
2026-07-19T05:57:30.645Z **BROKEN** lightningd: backtrace: lightningd/onchain_control.c:412 (replay_block) 0x55746823bfb8
2026-07-19T05:57:30.645Z **BROKEN** lightningd: backtrace: lightningd/bitcoind.c:463 (getrawblockbyheight_callback) 0x557468204ac0
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: lightningd/plugin.c:700 (plugin_response_handle) 0x55746825a81a
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: lightningd/plugin.c:789 (plugin_read_json) 0x55746825fc21
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x5574682dbb59
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x5574682dbb59
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x5574682dbb59
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:470 (io_loop) 0x5574682dce55
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x55746822e130
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1457 (main) 0x55746820056b
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: ../sysdeps/nptl/libc_start_call_main.h:59 (__libc_start_call_main) 0x7f88a67e7e99
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: ../csu/libc-start.c:360 (__libc_start_main_impl) 0x7f88a67e7fb5
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x557468202860
2026-07-19T05:57:30.646Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff
```

It's hard to reproduce.

Start with lightningd/onchain_control.c, especially replay_tx_hash_lock at line 43 and replay_block at line 412, then inspect ccan/ccan/htable/htable.c:145. Use the provided backtrace to trace the crash path through getrawblockbyheight_callback; done means identifying the cause of the segfault and validating a fix despite the issue noting that reproduction is difficult.

Written by the indexing model from the issue text.