test(eth): EIP-1559 chunked-data regression guard (firmware 7.14.1+)

[BitHighlander]

Summary

Permanent regression guard for the EIP-1559 chunked-data signing bug that shipped in firmware 7.x.0 .. 7.14.0 and was fixed in 7.14.1.

The bug: firmware/ethereum.c hashed the empty access-list byte (0xC0) — which closes the EIP-1559 RLP body and must be the last byte fed to keccak before signing — inside ethereum_signing_init() immediately after the initial 1024-byte data chunk, before the host had a chance to send the remaining EthereumTxAck frames. For any tx whose data exceeded the single-USB-chunk threshold (1024 B), the firmware produced a non-canonical pre-image:

keccak( ...header...
        || data_len_prefix
        || data[0..1024]
        || 0xC0           ← bug: should be after ALL data
        || data[1024..end] )

The signature was mathematically valid for the mangled hash so RPCs accepted the broadcast, but the recovered signer was a wrong-but-deterministic address. The mempool dropped the tx because the recovered from had no balance / wrong nonce. Production symptom: every Uniswap Universal Router swap, Permit2 batch, and large multicall on affected firmware hung at "Confirm in wallet."

Single-chunk transactions (≤ 1024 B) escaped the bug only by accident — the misplaced 0xC0 happened to land at the end anyway.

What this PR adds

• tests/test_msg_ethereum_signtx_chunked_data_eip1559.py — recovery-based, seed-agnostic regression. Pairs the device with the all-all-all test mnemonic, signs a 1550-byte EIP-1559 transaction (same size class as the captured production failure), builds the canonical type-2 unsigned-envelope keccak hash, performs ECDSA recovery, and asserts the recovered address equals the device's own EOA. No golden vectors to maintain — asserts the actual invariant: "signature recovers to the signer."
• .github/workflows/ci.yml — adds eth-keys + pycryptodome to the existing pip install line. Pure-Python keccak via eth-utils, no native deps.
• scripts/generate-test-report.py — adds an E5b row so the test surfaces in the test report.

Difference from #191

Previous PR (#191, closed) gated on requires_firmware("7.2.1") — the version EIP-1559 support landed — so it was intentionally RED on every emulator pinned to ≤ 7.14.0. That made sense as a one-shot bug catcher but is the wrong shape for an ongoing CI guard.

This PR gates on requires_firmware("7.14.1") so the test skips on broken firmware and runs+passes on fixed firmware. CI stays green; the test still fails loudly on any future regression.

Test plan

• CI runs: test SKIPS on emulators pinned to firmware ≤ 7.14.0 (expected — gate skips).
• After the firmware fix is merged and the emulator pin is bumped to 7.14.1+, re-run CI → expect ✅ PASS.
• Manual run against a 7.14.1 device: pytest tests/test_msg_ethereum_signtx_chunked_data_eip1559.py passes.