fix(bitcoin-only): enforce Vault API boundary

[BitHighlander]

Summary

• enforce the Bitcoin-only product boundary at REST, renderer RPC, background services, cached state, device callbacks, watch-only snapshots, and hot transitions
• reject dedicated altcoin routes before auth UI, stale reads, network access, or device dispatch; constrain generic UTXO, xpub, Pioneer data, and batch-key routes to Bitcoin/Testnet identities
• revalidate queued REST signing approvals against the device present at approval time, closing the full-firmware -> Bitcoin-only swap race
• hide stale full-firmware activity, swaps, debug state, ledger, reports, watch-only state, address-book history, WalletConnect, and MCP/BEX state
• enforce offline and self-host backend boundaries: no hidden Pioneer fallback; Blockbook provides history/discovery, while Core fails closed when safe change discovery is unavailable
• add a non-destructive physical runner for BIP44/49/84/86 address display, offline synthetic signing, exact transaction parsing, cancellation, and direct REST/v2/bridge fences
• add an executable Linux CI gate for the Bitcoin-only host policy instead of relying on packaging alone

Verification

• Bitcoin-only policy: 26 tests / 197 expectations
• CI host gate: 41 Bun tests / 232 expectations, plus 87 standalone backend/policy assertions and physical-runner syntax validation
• Core: 35 assertions; normalization: 16; device-only: 5; address discovery: 6; offline: 10; Pioneer guard: 15
• production backend bundle: passed (7.98 MB)
• exact Vault head 41c0702c5489e1427a1c44e70c60406745d38697: macOS and Linux packaging green in run 32686391124
• exact macOS artifact SHA-256: a28be49e7663e637682ffa767341e94d059c2c3cb4b0eee3869cff5f90dd03e4

Physical merge gate

Do not merge until the exact merged-alpha firmware and exact Vault artifact complete the preserved hardware evidence:

1. Run the SDK/Vault boundary and synthetic signing runner for BIP44/P2PKH, BIP49/P2SH-P2WPKH, BIP84/P2WPKH, and BIP86/P2TR; compare every OLED address/QR and amount/address/fee screen exactly, including cancellation.
2. Pioneer: normal P2WPKH and P2TR receive/sign/broadcast with a disposable funded wallet.
3. Blockbook: history-derived receive/change discovery and broadcast, with no Pioneer chain-data fallback.
4. Bitcoin Core: explicit history/discovery limitation; no-change/send-max only. A change-bearing send must fail before signing.
5. Offline: cached reads and local address/signing work; broadcast/fees/history/market/update/pairing/swap/sweep/report fail closed; confirm no outbound sockets.
6. Hot transition: full firmware -> Bitcoin-only without restarting Vault; WalletConnect, pending deep links, alt balances/xpubs/activity/ledger/reports/watch-only/address-book state, and background probes must not cross the boundary.
7. Verify the storage-band migration on the physical reboot/flash path. The Python CI storage-version tests are explicitly skipped because their container cannot own/restart a kkemu process.

Operator handoff: docs/handoff-testing/09-alpha-bitcoin-only.md.

Firmware counterpart is merged into alpha. Exact alpha head 78cbd653461752c7d9b32a36bc05adcf9d49bd2a passed the full firmware matrix. Its unsigned Bitcoin-only test artifact hashes to 2b6864c9ed2afa75af40fb01a06941122baeb2b4c1dd077fee1b47459e61f3a7; physical evidence remains required.

[BitHighlander]

Pioneer handoff added at docs/handoff-pioneer-alpha-bitcoin-only.md on f3f1846. Live production/blue probes confirm: BTC testnet is unsupported; fee units are implicit; malformed ListUnspent can return HTTP 200 []; pubkey-info and lookup failures can return HTTP 200 success:false. The same commit makes Vault fail closed on those application errors, fixes LookupUtxoTx/raw-prev-tx unwrapping, and closes the offline/testnet Pioneer bypass. No public issue was opened. Exact-head CI run: 32688436990.