fork companion CircleCI clones upstream and never tests security branches

[BitHighlander]

Summary

The companion python-keepkey CircleCI job does not test fork pull-request branches. Its first step constructs this clone unconditionally:

git clone --depth 1 -b "$CIRCLE_BRANCH" https://github.com/keepkey/python-keepkey.git .pykk

Fork-only branches such as BitHighlander/python-keepkey:fix/alpha-audit-followups do not exist in keepkey/python-keepkey, so the required ci/circleci: emulator-build-test context fails before checkout or testing.

CircleCI build 358 at Python head f19a5f6a confirms exit 128 in 174 ms at Clone python-keepkey (current branch). The job then never exercises the emulator, screenshot gate, storage fixtures, or signing tests.

Security/CI impact

• The fork tracker reports a required red check unrelated to the patch.
• More importantly, the legacy job cannot provide any independent evidence for fork-only security remediations.
• Its firmware checkout also follows an environment-provided master branch rather than the exact companion firmware revision, so even a successful checkout can test a different signing implementation than the Python regression targets.

Required remediation

• Clone ${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME} over HTTPS at the exact $CIRCLE_BRANCH, rather than hard-coding the upstream owner.
• Pin the firmware checkout to the exact companion revision under review, matching the GitHub Actions integration lane.
• Confirm CircleCI reaches the emulator suite and reports its own status file rather than failing at clone time.

Evidence: https://circleci.com/gh/BitHighlander/python-keepkey/358

[BitHighlander]

Fixed in BitHighlander/python-keepkey#59 at d3660b12, pinned by firmware PR #587 at 78731bc0c.

CircleCI now clones the repository owner/name supplied by CircleCI at the fork branch, and fetches exact companion firmware ec9ced7f23b119878961ee6571da29b035cf11fb, matching the GitHub Actions integration lane. The new CircleCI build is being observed to ensure it reaches and completes the emulator tests before this issue is closed.