feat(clearsign): authenticate Portals EVM swaps

[BitHighlander]

Outcome

Fixes the reported ETH-to-Base Portals route without enabling Advanced Mode. Vault asks the production ClearSign service by privacy-preserving shape only, attaches the certified v4 envelope, and lets 7.16 decode the real transaction on-device.

User review

The device shows:

• Authenticated by KeepKey, signer alias and fingerprint;
• Portals swap and the full pinned router address;
• output token;
• minimum output in honest raw token units;
• recipient;
• native ETH amount and fee from the transaction itself.

Fail-closed behavior

Unknown/malformed/service-declined routes retain the existing blind-signing gate. Vault validates service bindings and the certified key id before hdwallet; firmware validates both signatures, exact chain/router/selector, ABI structure, outer order fields, and msg.value == inputAmount. The cloud signer never receives calldata or argument values and cannot supply displayed values.

Evidence

• Firmware PR: feat(clearsign): decode certified Portals native swaps BitHighlander/keepkey-firmware#612
• Production worker scopes: Ethereum ready, Solana ready; delegate a9531b9d.
• Exact captured shape: contract 0xbf5A...5E62, selector 0xa2e42c65, 1,476 bytes -> VERIFIED v4 envelope.
• 15 Vault/worker focused tests passed; backend bundle passed.
• Docker firmware build: all 543 firmware, 21 board, 18 crypto, and 6 Pallas tests passed.