staticaddr/deposit: separate generic OnError from caller-held rollback events

Problem

The static-address deposit FSM currently treats fsm.OnError as if it always arrives while the caller already holds the deposit lock.

That assumption is not reliable. Some fsm.OnError transitions do come from TransitionDeposits, where the manager locks deposits before sending the event. But deposit FSM actions can also emit fsm.OnError internally. Examples include:

• PublishDepositExpirySweepAction returning fsm.OnError after expiry sweep publish failures;
• WaitForExpirySweepAction returning fsm.OnError after notifier or context errors.

Those internal paths originate from the deposit FSM's own block handling, so no external deposit lock is held.

Because fsm.OnError is in lockedEvents, updateDeposit can skip acquiring the deposit lock, call no-lock state mutation helpers, and update the store under an assumption that is false for internally generated errors.

This was discussed during PR #1161: https://github.com/lightninglabs/loop/pull/1161#discussion_r3539803146

The issue appears to predate PR #1161, but that PR touched the surrounding deposit locking/lifecycle code and made the invariant visible.

Potential fix

Do not use the generic fsm.OnError event to also mean "caller-held rollback/unlock to Deposited".

One possible shape:

• introduce a deposit-specific rollback event, for example OnReleaseDeposit or OnDepositRollback;
• use that event from manager-driven TransitionDeposits callers that already hold deposit locks and need to move selected deposits back to Deposited;
• include that specific rollback event in lockedEvents;
• remove generic fsm.OnError from lockedEvents, so internally generated errors acquire the deposit lock inside updateDeposit;
• keep fsm.OnError as the generic action-error transition in the deposit FSM, not as an implicit lock-state signal.

That separates event meaning from caller locking context: events sent by TransitionDeposits can still avoid double-locking, while internally generated fsm.OnError paths no longer run no-lock state/store updates without a held deposit lock.

Start by tracing updateDeposit, lockedEvents, and TransitionDeposits, then inspect the deposit FSM actions PublishDepositExpirySweepAction and WaitForExpirySweepAction. Separate the caller-held rollback event from generic fsm.OnError so internally generated errors acquire the deposit lock, while manager-driven rollback avoids double-locking. Done means both paths preserve the intended state and store updates without relying on an incorrect lock assumption.