ci(firmware): pin the emulator build to an immutable revision

Both integration jobs cloned BitHighlander/keepkey-firmware at `alpha`, a
moving branch. A firmware push could therefore change this PR's result with
no Python commit, which makes any green run unciteable as evidence.

Pin both to a710bb57. That SHA is alpha at the time of pinning, and it is
7.16.0 -- NOT 7.15.0/RC18. The suite needs firmware that only exists after
RC18: variant_getName() returning "EmulatorBTC", which requires_bitcoinOnly()
and therefore the whole integration-btc job depend on, and the Ironwood
known-answer vectors. Pinning to audit/7.15.0-rc18-final would fail both.
The comment says so, so the next reader does not mistake a green run for
validation of the RC18 dependency graph.

Also gate the two Ironwood device tests to 7.16.0. The class-level
requires_firmware("7.15.0") is a floor, so they would otherwise run against
RC18, whose zcash.cpp has no IronwoodNoteCommitment_V3KnownVector. This is a
firmware-support gate, not a wire-contract one: messages-zcash.proto marks
only sapling_digest reserved-and-rejected.

Author: pastaghost

.github/workflows/ci.yml

@@ -113,7 +113,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: BitHighlander/keepkey-firmware
-          ref: alpha
+          # PINNED, not `alpha`. A moving branch means a firmware push can
+          # change this PR's result with no Python commit, which makes a green
+          # run unciteable. This SHA is alpha at the time of pinning.
+          #
+          # NOTE: this is 7.16.0, NOT 7.15.0/RC18. The suite needs firmware
+          # that only exists after RC18 -- variant_getName() returning
+          # "EmulatorBTC" (required by requires_bitcoinOnly, so by the whole
+          # integration-btc job) and the Ironwood known-answer vectors. So this
+          # job validates 7.16.0; it does not validate the RC18 dependency
+          # graph. Bump deliberately, and re-read that claim when you do.
+          ref: a710bb5777f3ad888bb489b383dbafab800d55c6
           path: keepkey-firmware
 
       # NOT `submodules: recursive`. trezor-firmware carries a micropython
@@ -334,7 +344,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: BitHighlander/keepkey-firmware
-          ref: alpha
+          # PINNED, not `alpha`. A moving branch means a firmware push can
+          # change this PR's result with no Python commit, which makes a green
+          # run unciteable. This SHA is alpha at the time of pinning.
+          #
+          # NOTE: this is 7.16.0, NOT 7.15.0/RC18. The suite needs firmware
+          # that only exists after RC18 -- variant_getName() returning
+          # "EmulatorBTC" (required by requires_bitcoinOnly, so by the whole
+          # integration-btc job) and the Ironwood known-answer vectors. So this
+          # job validates 7.16.0; it does not validate the RC18 dependency
+          # graph. Bump deliberately, and re-read that claim when you do.
+          ref: a710bb5777f3ad888bb489b383dbafab800d55c6
           path: keepkey-firmware
 
       # Same non-recursive init as the regular job: trezor-firmware's

tests/test_msg_zcash_sign_pczt_device.py

@@ -280,13 +280,28 @@ def test_note_commitment_binds_the_recipient(self):
             self.client.zcash_sign_pczt(**sign_kwargs(actions))
         self.assertIn('commitment mismatch', str(caught.exception))
 
+    # The Ironwood pool is NOT part of the 7.15/RC18 product. The note
+    # fixtures below come from unittests/firmware/zcash.cpp, and
+    # IronwoodNoteCommitment_V3KnownVector does not exist on the RC18 branch
+    # (audit/7.15.0-rc18-final) -- it arrives with 7.16. The class-level
+    # requires_firmware("7.15.0") is a FLOOR, so without this these two would
+    # run against RC18 and fail. Gate them to the release that implements the
+    # pool, so RC18 skips instead.
+    #
+    # NB: this is about firmware support, not the wire contract.
+    # messages-zcash.proto marks only `sapling_digest` as reserved and
+    # currently rejected; `shielded_pool` and `ironwood_digest` are ordinary
+    # v6 fields there.
+    IRONWOOD_FIRMWARE = "7.16.0"
+
     def test_pool_selection_is_honoured(self):
         """The same note commits differently in each pool.
 
         Orchard and Ironwood derive a different cmx from identical inputs, so
         offering the Orchard commitment while declaring the Ironwood pool must
         be rejected. If the device ignored shielded_pool this would pass.
         """
+        self.requires_firmware(self.IRONWOOD_FIRMWARE)
         actions = [note_action(CMX_ORCHARD)]
 
         with self.assertRaises(Exception) as caught:
@@ -299,6 +314,7 @@ def test_ironwood_note_is_accepted(self):
         The positive half of the pool test -- together they prove the branch is
         selected by shielded_pool rather than one path serving both.
         """
+        self.requires_firmware(self.IRONWOOD_FIRMWARE)
         actions = [note_action(CMX_IRONWOOD)]
         screens = self._capture_button_screens()