Solana stake clear-sign screens omit stake, vote, source, and destination accounts

[BitHighlander]

Summary

Several Solana Stake Program instructions remain on the verified clear-sign path while the device omits the stake/vote/source/destination account identities parsed from the signed message:

• DelegateStake parses the stake account (pi->from) and vote account (pi->to) but displays only Delegate stake?.
• Split parses source stake account (pi->from) and destination split account (pi->to) but displays only the amount.
• Deactivate parses the stake account (pi->from) but displays only generic action text.
• Merge parses destination (pi->to) and source (pi->from) stake accounts but displays only Merge stake accounts?.

This is present on current alpha and is not covered by PR #557. It was found while independently reviewing that PR's Solana clear-sign changes.

Security impact

A compromised host can change the account(s) acted upon while preserving an identical device prompt. In particular, delegation to a different validator vote account and merging/splitting different stake accounts are not distinguishable to the user at approval time.

Code evidence

lib/firmware/solana.c fills pi->from/pi->to for these instruction types. lib/firmware/fsm_msg_solana.h renders generic prompts for SOL_INSTR_STAKE_DELEGATE, SOL_INSTR_STAKE_SPLIT, SOL_INSTR_STAKE_DEACTIVATE, and SOL_INSTR_STAKE_MERGE without those fields.

Acceptance criteria

• Display all security-relevant source/destination/vote/stake accounts before approval, or downgrade these instructions to opaque/Advanced Mode until complete screens exist.
• Add parser/review regression tests proving each signed identity is rendered or the instruction fails closed.
• Preserve existing signer-in-transaction verification.

[BitHighlander]

Resolved on alpha by #587 (merge 893c93d). The final immutable head e4ec531 passed both complete CI workflow runs.