fix(tests): the display-disclosure suite was passing vacuously

setUp() inherits a device wipe and never loads a seed, so every SignMessage
in this file was refused with Failure_NotInitialized before confirm_bytes()
was ever reached. _sign_message_screens() caught the CallException and
returned None, and _assert_distinguishable() returned early on None without
executing its assertNotEqual.

Four tests therefore reported PASS having exercised zero display logic, and
the fifth -- written specifically to catch exactly this -- skipped ITSELF on
the same condition. Reintroducing the NUL-truncation bug, so that
b"benign login\x00 AND APPROVE TRANSFER OF ALL FUNDS" renders identically to
b"benign login" while the signature covers all 46 bytes, would leave every
test, the JUnit validation and the ci-gate green. The release PDF certifies
this coverage as passing.

Three changes:

- setUp() loads a seed, so the device actually renders the screens under test.

- A refusal no longer silently satisfies the property. It asserts the device
  is initialized first -- a refusal only means something from a device that
  could have signed and chose not to -- and otherwise fails by name. An
  intended refusal should be asserted explicitly, not inferred from None.

- The anti-vacuity control no longer skips itself. That test exists to prove
  the rest of the file is not vacuous, so skipping when the device will not
  sign is the one failure mode it cannot be allowed to have.

Author: BitHighlander

tests/test_msg_display_disclosure.py

@@ -131,6 +131,13 @@ class TestDisplayDisclosesSignedContent(common.KeepKeyTest):
     def setUp(self):
         super(TestDisplayDisclosesSignedContent, self).setUp()
         self.requires_firmware(self.MIN_FIRMWARE)
+        # The inherited setUp wipes the device. Without a seed every
+        # SignMessage below is refused with Failure_NotInitialized before
+        # confirm_bytes() is ever reached, _sign_message_screens() returns
+        # None, and _assert_distinguishable() returns without asserting -- so
+        # the whole suite passed while exercising zero display logic. Load a
+        # seed so the device actually renders the screens under test.
+        self.setup_mnemonic_nopin_nopassphrase()
 
     # ── helpers ─────────────────────────────────────────────────────────
 
@@ -165,8 +172,22 @@ def _assert_distinguishable(self, a_label, a_msg, b_label, b_msg):
         b = self._sign_message_screens(b_msg)
 
         if a is None or b is None:
-            # Refusing to display something it cannot show honestly is a pass.
-            return
+            # A refusal is only meaningful from an initialized device that
+            # could have signed and chose not to. On an uninitialized device
+            # every call is refused for an unrelated reason, which is what let
+            # this suite pass vacuously -- so assert the device can sign at
+            # all before treating a refusal as the honest-refusal pass.
+            self.assertTrue(
+                self.client.features.initialized,
+                "device is not initialized, so this refusal says nothing "
+                "about display disclosure -- the assertion below never ran")
+            refused = a_label if a is None else b_label
+            raise AssertionError(
+                "device refused to sign %s. Refusing to display what it "
+                "cannot show honestly is defensible, but it must be an "
+                "explicit, reviewed decision rather than a silent pass: if "
+                "this is intended, assert the refusal here by name."
+                % refused)
 
         self.assertNotEqual(
             a, b,
@@ -244,8 +265,14 @@ def test_signing_shows_at_least_one_screen(self):
         empty tuples and the suite would pass while showing the user nothing.
         """
         screens = self._sign_message_screens(b"hello")
-        if screens is None:
-            self.skipTest("device refused to sign the control message")
+        # Do NOT skip here. This test exists to prove the rest of the file is
+        # not vacuous, so skipping itself when the device will not sign is the
+        # one failure mode it cannot be allowed to have -- that is exactly how
+        # the whole suite went green against an uninitialized device.
+        self.assertIsNotNone(
+            screens,
+            "device refused to sign the control message, so every comparison "
+            "in this file compared None against None and asserted nothing")
         self.assertGreater(
             len(screens), 0,
             "signing produced no ButtonRequest, so nothing was shown to the "