Ledger Bitcoin app

This commit hardens a Bitcoin transaction parser in Ledger's app. It changes some numeric fields to safer types, adds bounds checks on transaction counts and sizes, rejects extra trailing bytes after a transaction, checks a previously-ignored internal buffer operation, and zeroes out result memory before use. These are defensive fixes that could prevent memory corruption, incorrect parsing, or information leakage, but the commit does not describe a specific active exploit.

This commit changes what information the Ledger Bitcoin app shows on its screen when signing a transaction that includes 'external inputs'—coins the user did not provide and whose amounts the device cannot independently verify. Previously the app only warned that such inputs exist. After this change, when the signature commits to the full set of inputs (i.e., no ANYONECANPAY sighash flag), the app also displays the total value of those external inputs and the net amount the user's wallet is spending or receiving. This is a user-interface improvement intended to reduce confusion, not a fix for a code-execution or theft vulnerability. The underlying security model—external inputs are still 'unverified'—is unchanged.

This commit only updates test screenshot snapshots for the Ledger Bitcoin app. It does not change any application source code, so it cannot directly fix or introduce a security vulnerability in the shipped app. The snapshots reflect new expected screen output after a prior code change that altered how amounts and fees are displayed when signing transactions with non-default Bitcoin sighash types.

This commit only adds and updates automated integration tests for the Ledger Bitcoin app. It does not change the app's actual signing code. The tests verify that the device now shows clearer, more trustworthy on-screen amount and fee information when a transaction uses unusual Bitcoin signature modes (non-default 'sighash' types). Because no production firmware code is modified, there is no direct security vulnerability or fix introduced by this commit itself.

This commit changes how the Ledger Bitcoin app shows transaction amounts and fees on the device screen when a user signs a transaction that does not use the normal 'sign everything' rule (a so-called non-default sighash). Previously the app might have displayed a fee or total that could actually change later, because some sighash types let other people add inputs or change outputs after the signature. Now the app detects those cases and either shows only the net amount the user is spending/receiving, or shows a warning that amounts cannot be verified. It also adds a 'Signing rule' line so the user knows the transaction is not fully committed.

This commit adds test-only helper code for creating Bitcoin transaction fixtures that support newer wallet types (MuSig2 multi-signature and several legacy/wrapped SegWit descriptor forms). It is not a change to the Ledger app firmware itself, but to Python utilities used in automated tests. There is no obvious security bug introduced, and the commit does not claim to fix a vulnerability.

This commit is purely about improving the project's automated test setup. It links unit tests to a software simulator (Speculos) so cryptographic code can be tested on a regular computer without a physical Ledger device. It adds tests for a Bitcoin key-derivation function and re-enables an existing test file. There is no change to the actual app code that runs on the device, and nothing in the commit suggests a security vulnerability or fix.

This commit is purely a testing infrastructure cleanup. It removes a workaround called SKIP_FOR_CMOCKA that previously hid parts of the code from unit tests, and instead compiles those parts using a more realistic emulator bridge (speculos). No user-facing behavior of the Bitcoin app changes, and no security bug is fixed or introduced in the diff.