fix(rc24): add Taproot and entropy host acceptance

[BitHighlander]

Summary

• pins device-protocol 674777f6d4dd16e2b8c4c2df10608976375ee879 and hdwallet db9233f3de144ab2a867ed26c85c3f72748de819
• adds capability-gated BIP86/P2TR discovery and Bech32m transaction support
• makes trusted-display address requests bypass the cache
• exposes authenticated binary GetEntropy through Vault and keepkey-sdk
• adds guarded RC24 physical acceptance phases for Taproot, P2WPKH control, locked entropy, and the 64 KiB entropy budget

Release blocker addressed

The exact RC23 candidate returned a valid 64-byte Schnorr signature for a P2TR transaction without showing any physical transaction confirmation. RC23 is blocked. The RC24 hardware phase in this PR requires exact firmware-hash matching, recipient/fee attestation, cancellation rejection, and never broadcasts its synthetic transactions.

This host PR must be tested with the fail-closed firmware repair in keepkey-firmware #330, the BIP86 change-output guard in #333, and repaired entropy #332. It does not make the firmware release-ready by itself.

Verification

• Vault focused tests: 42 passed, 0 failed
• SDK: clean npm ci; 10 unit tests plus RC24 contracts passed
• Vault backend bundle: passed at the exact pinned submodule SHAs
• diff check: passed
• physical RC24 phases: pending an exact built/flashed RC24 artifact

Scope

Taproot and entropy only. x402, ClearSign, and unrelated stacked work are intentionally excluded.