Test `ChangeSet` invariants

## Description

`ChangeSet` has three write-once fields — `descriptor`, `change_descriptor`, and `network` — that must never change after wallet creation. The `Merge` implementation enforces this with `debug_assert!`, which is of course compiled out in release builds, leaving potential gaps in test coverage.