fix(security): consolidate 7.14.2 audit remediation

[BitHighlander]

Summary

Consolidated remediation for the frozen 7.14.2 release head after the latest cross-cutting signing audit.

• fail closed before ButtonRequest when confirmation source formatting loses text
• disclose SignIdentity index, curve, full path, and long visual challenges
• remove legacy MakerDAO specialized clear-signing from the dispatcher
• validate Osmosis display/JSON fields and canonical IBC numeric fields
• tighten THORChain/MAYAChain structured memo tokens, byte grammar, and basis points
• scrub canceled reset mnemonics and authenticator secrets/cache
• make malformed continuations and second signing starts terminal
• apply auto-lock while workflows wait on the host
• add regression coverage for each failure class

The review also caught and fixed a new basis-point accumulator wrap case: 4294967296 could wrap to 0 and re-enter the accepted THOR/MAYA range.

Scope

• Base: 2a430da
• Remediation and companion-test pin: 25 files, +551/-155
• No documentation or report-infrastructure changes
• The pre-existing dirty crypto dependency submodule remains excluded
• The Python companion pin is intentional and points to test(ethereum): require advanced mode for MakerDAO calldata python-keepkey#221, based on the active 7.14.2 companion-test branch

This PR targets release/7.14.2-rc31, the head branch of parent PR #458.

Validation

• clang-format 20: clean
• git diff --check: clean
• pinned container: kktech/firmware@sha256:7438e53933d47d53157ed6d96d864cb208597e62dce26235ace09d1063427fa2
• firmware unit suite: 131/131 passed
• board unit suite: 16/16 passed
• crypto unit suite: 4/4 passed
• the previously failing auto-lock test now passes with the initialized OLED harness
• companion test syntax and offline-fixture manifest checks passed

The first exact-head CI run exposed four stale MakerDAO Python tests that still attempted contract-data signing without AdvancedMode. The companion update makes those vectors exercise the generic blind-signing path while retaining their deterministic signature checks. Exact-head CI is rerunning with that pin.

Release posture

This is a reviewable remediation PR, not release authorization. 7.14.2 remains NO-GO pending exact-head CI, the repeated frozen-head failure-class sweep with planted controls, independent approval, and the remaining hardware/storage gates. Nothing was signed, tagged, merged, or installed on hardware.