Don't mutate Plans when signing

This is achieved by not using the Plan struct anymore, yet rather its
decomposition. While less ergonomic, it meets our wants re: safety.

processor/src/plan.rs

@@ -113,16 +113,10 @@ impl<N: Network> Plan<N> {
       transcript.append_message(b"input", input.id());
     }
 
-    // Don't transcript the payments as these will change between the intended Plan and the actual
-    // Plan, once various fee logics have executed
-    // TODO: Distinguish IntendedPlan and ActualPlan, or make actual payments a distinct field,
-    // letting us transcript this
-    /*
     transcript.domain_separate(b"payments");
     for payment in &self.payments {
       payment.transcript(&mut transcript);
     }
-    */
 
     if let Some(change) = &self.change {
       transcript.append_message(b"change", change.to_string());
@@ -138,11 +132,6 @@ impl<N: Network> Plan<N> {
     res
   }
 
-  pub fn expected_change(&self) -> u64 {
-    self.inputs.iter().map(|input| input.amount()).sum::<u64>() -
-      self.payments.iter().map(|payment| payment.amount).sum::<u64>()
-  }
-
   pub fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
     writer.write_all(self.key.to_bytes().as_ref())?;