feat(zcash): add NU6.3 Ironwood transactions

[BitHighlander]

Why

NU6.3 separates Ironwood from the legacy Orchard value pool. The previous Vault runtime still sent a v5/Orchard ZcashSignPCZT, so transparent shielding produced a negative Orchard value balance and every node rejected the transaction.

What changed

• upgrade the Zcash crate cohort for NU6.3, Ironwood, V3 note plaintexts, and transaction v6
• implement ZIP-229 five-component txid and sighash calculation plus canonical v6 serialization
• build shield, private-send, and deshield PCZTs in the Ironwood pool
• scan distinct Orchard and Ironwood compact actions, trees, subtree roots, nullifiers, and balances
• migrate the wallet database to retain each note source pool
• expose separate Orchard and Ironwood balances and update receive and shield terminology
• pin device-protocol to the exact upstream Ironwood commit f2246cebea8f96fcd7ec2883588a784a60b430ae
• pin hdwallet to the complete validated integration commit 94ed6cdb525708f3eb14933ec4a68b291c151431, which consumes @bithighlander/device-protocol@7.17.0 through the established npm staging flow
• run canonical GitHub Actions for develop pushes and pull requests
• honor proto-tx-builder's committed Yarn lockfile in local and CI builds
• initialize proto-tx-builder's nested Osmosis sources before Yarn's install-time build

The temporary Vault-side protocol source-build and SOP rewrite were reverted. Vault retains its established packaging flow.

Legacy Orchard notes remain scanned and visible, but this spike intentionally does not combine legacy Orchard spends with Ironwood outputs in one v6 transaction. New transaction builders spend Ironwood notes only; a cross-pool migration flow is follow-up work.

Validation

• cargo fmt --check
• cargo test — 66 passed, 1 intentionally ignored
• canonical v6 round-trip regression covers empty Orchard plus populated Ironwood serialization and txid agreement
• hdwallet integration: build, lint, 11 suites / 118 tests passed
• make modules-build passed
• full local make build passed, including release-mode sidecar, backend bundle, Vite renderer, dependency collection, and Electrobun app build
• hardware/mainnet transparent-to-Ironwood shield succeeded: tx ac7f54975154f9c242a49fa151bcbc2badbb7591a8877ff9f75dbba305fdf2fd, confirmed in block 3430876 for 14,742,242 ZAT

The sandbox cannot bind the test HTTP server used by tron-memo-inject.test.ts; the remaining deterministic unit suites passed locally. GitHub Actions is the authoritative clean-environment gate and now runs on this develop PR.

Staging graph

• keepkey/device-protocol: f2246cebea8f96fcd7ec2883588a784a60b430ae
• keepkey/python-keepkey: d88a073a5af2d83e0f1f19574665ca1a44789414, nested protocol pin f2246ce
• keepkey/hdwallet#59: 94ed6cdb525708f3eb14933ec4a68b291c151431, published staging package @bithighlander/device-protocol@7.17.0, canonical GitHub Actions green
• this Vault head: 6722fa142a059c4682ad43d1e3109bc3d15d4bbc, protocol submodule f2246ce, hdwallet submodule 94ed6cdb

modules/keepkey-firmware is an emulator fixture and is not a Vault release gate under the repository SOP. No upstream firmware release promotion is part of this PR.

Remaining gate

Keep this PR draft until its newly enabled GitHub Actions matrix is green and the human review is complete.

[BitHighlander]

Reviewed the complete 19-file Ironwood/Vault diff and its dependency-pin changes. I found no blocking correctness or integration issue.

Review points verified:

• transaction-v6 construction requires the NU6.3 branch ID and uses the separate Ironwood ZIP-229 digest slot
• Orchard and Ironwood notes, balances, nullifiers, trees, and scan data remain explicitly separated; the database migration classifies existing rows as legacy Orchard
• finalization revalidates bundle version, proof/signatures/binding authorization, component digest, and consensus sighash before serialization
• Vault pins the validated protocol and hdwallet staging commits and uses the repository's locked module build flow
• legacy Orchard notes remain visible but are deliberately not mixed into normal Ironwood v6 sends; migration remains a documented follow-up

Validation repeated at head 6722fa14:

• cargo fmt --check passed
• cargo test passed: 66 passed, 1 fixture test intentionally ignored
• git diff --check passed
• canonical GitHub Actions passed on Linux and macOS
• hardware/mainnet transparent-to-Ironwood shield was already confirmed in block 3430876

No unresolved review threads or remaining code-review blockers.