Fix memory leak in EVM BIP32 child key derivation

[Copilot]

The deriveChild function in src/lib/crypto/evm.ts was not cleaning up the pubKey intermediate value during non-hardened key derivation, potentially leaking cryptographic material in memory.

Changes:

• Track pubKey as nullable variable scoped to try/finally block
• Zero pubKey in finally clause using secureZero()
• Zero old pubKey before reassignment in retry loop iterations

This matches the pattern established in src/lib/crypto/bitcoin.ts (commit 76e8856).

// Before: pubKey created but never cleaned up
} else {
  const pubKey = secp256k1.getPublicKey(parentKey, true);
  data.set(pubKey, 0);
}

// After: pubKey tracked and securely zeroed
let pubKey: Uint8Array | null = null;
try {
  // ...
  } else {
    if (pubKey !== null) secureZero(pubKey);  // Clean on retry
    pubKey = secp256k1.getPublicKey(parentKey, true);
    data.set(pubKey, 0);
  }
} finally {
  if (pubKey !== null) secureZero(pubKey);  // Clean on exit
}

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[cloudflare-workers-and-pages]

Deploying vidulum-app with    Cloudflare Pages

Latest commit:	9e3b710
Status:	✅  Deploy successful!
Preview URL:	https://8052453a.vidulum-app.pages.dev
Branch Preview URL:	https://copilot-sub-pr-52-another-on.vidulum-app.pages.dev

View logs