How does KIP-20 prevent forged covenant state in Kaspa?

KIP-20 makes it impossible to create a coin that falsely claims to belong to a Kaspa covenant unless that coin is genuinely the covenant's starting point or a valid next step in its chain. A UTXO (unspent transaction output) is essentially a coin sitting on the Kaspa network, waiting to be spent. In Kaspa's covenant system, some UTXOs carry a label identifying them as part of a specific covenant. Without protection, a bad actor could fabricate a coin with that label and inject a counterfeit state into a running application. KIP-20 closes that gap at the consensus layer — covenant-labeled UTXOs are uncreatable unless they are either a valid genesis initialization or a valid continuation of a prior covenant coin. This matters to beginners because it gives stateful Kaspa applications a foundational security guarantee: the protocol itself rejects any attempt to spoof the application's on-chain state from outside its own rules.