feat(zcash): add NU6.3 Ironwood signing metadata

[BitHighlander]

Why

NU6.3 activates the Ironwood value pool and transaction v6. The existing PCZT wire message could only identify Orchard and only carried the four v5 transaction component digests, so firmware could not safely distinguish or verify an Ironwood signing request.

Root cause

ZcashSignPCZT had no shielded-pool discriminator and no Ironwood component digest. Continuing to encode post-NU6.3 shielding as Orchard produces a negative Orchard value balance, which consensus now rejects.

What changed

• adds an additive ZcashShieldedPool enum with Orchard as wire-compatible default
• adds shielded_pool and the fifth v6 ironwood_digest field
• bounds the Ironwood digest for nanopb
• stages package version 7.17.0 for downstream hdwallet integration

Impact

Existing Orchard hosts remain wire-compatible because field 19 defaults to Orchard and all additions use new field numbers. Ironwood-capable hosts can now ask firmware to apply v6 digest and note-commitment rules.

Checks

• npm run build
• npm pack --dry-run --cache /private/tmp/keepkey-npm-cache
• consumed successfully by the KeepKey firmware device and emulator builds in the dependent spike

[BitHighlander]

Superseded by the canonical upstream protocol change in keepkey#113. Closing this fork/package-version path so the firmware stack has one protocol source and one exact pin: f2246ce.