test(7.15): ERC-7730 block 7 remediation and Phase 0 capability mirror - #227

…oder

Array-of-structs, Permit2 batch and multidimensional device walks now
compare the device's domain/message hashes with a spec-derived reference
encoder and recover the signature to the device address. The multidim
walk is Stack 07 work and is gated by the structured-EIP-712 probe, not
by the later evm-unknown-token-review capability.

…e wire

set_expected_responses() raised a CallException whose text embedded the
expected message, so the old assertIn passed whatever the device sent.
Send EthereumSignTx with call_raw and require the first response to be
Failure_ActionCancelled with the exact message (no ButtonRequest first).

…nputs

The firmware-validation step ran only behind 'if validator:' so compile
tests passed without ever reaching firmware. Missing validator or
registry is now an explicit skip, and a failure when CI sets
KK_REQUIRE_ERC7730_EVIDENCE=1.

…ong bytes

Every signing walk now requires exactly one ButtonRequest_SignTx
"Sign Typed Data" screen at the end. New device tests: declining that
screen returns ActionCancelled and no signature; primaryType
EIP712Domain signs keccak(0x1901||domainSeparator) (checked by the
independent encoder and signer recovery); unlimited EIP-2612 and Permit2
amounts are refused before their leaf is displayed; a 1024-byte bytes
leaf signs and verifies independently.

The registry conformance test had never run against a firmware
validator. Run through the firmware's own catalog verifier, 56 of the
1,450 official calldata formats compiled to programs the device
refuses:

- 46 tokenAmount fields with no token compiled to formatter kind 3,
  which the verifier refuses without a token argument. With no token the
  device can only show the raw integer, so compile the raw formatter.
- 8 paths iterated two nested arrays; the verifier accepts one "[]"
  step per path. Refuse them by name.
- 2 ABIs nested deeper than the device's 8 levels. Refuse them by name.

The registry test now requires every format to pass the firmware
validator or be refused for one of those named device limits, and pins
that count at 10.

The device response buffer is shared with DebugLink, and a state read
during the final sign screen erased an address written before it. The
signature still recovered to the right key, so only the reported address
was wrong. Under screenshot capture the unfixed firmware returns an empty
address and these assertions fail.

Firmware calldata and typed-data captures refuse ERC7730_ABI_MAX_DEPTH (8)
or more path steps, and the catalog verifier now does too. Refuse such
paths by name at compile time. No official registry format is affected.

Firmware now refuses at preload every ERC-7730 program its runtime cannot
finish, using one capability table shared by the verifier and the runtime.
Mirror that table here as DEVICE_CAPABILITIES:

- compile_calldata/compile_eip712 raise DeviceCannotExecute with the exact
  reason unless executable_only=False;
- device_refusal() reports why a compiled program would be refused;
- the registry test asserts that the device verifier and this mirror agree
  on every compiled format in both directions, and that exactly 92 of the
  1,450 official formats are signable (not 94: two raw fields read the
  @.from container, which the runtime never captured).

Also pin device-protocol at the canonical release protocol plus the Solana
LUT merge and DebugLinkState.confirm_title/confirm_body, and add
DebugLink.read_confirm_text() so tests can assert exact screen text.