test(zcash): cover NU6.3 Ironwood signing

[BitHighlander]

Why

NU6.3 adds the Ironwood value pool and transaction-v6 signing contract. The firmware integration harness must exercise the new pool selector and fifth ZIP-229 component digest before firmware can be considered releasable.

What changed

• pin device-protocol to the exact upstream Ironwood commit f2246ce
• regenerate the Python Zcash protobuf binding with the release-pinned toolchain
• expose shielded_pool and ironwood_digest through zcash_sign_pczt
• add an offline transaction-v6 contract test that asserts the NU6.3 branch ID, v6 group ID, pool selector, empty-Orchard digest, and Ironwood digest reach the wire unchanged
• preserve the legacy Orchard call shape and assert the new optional fields remain absent there

Validation

• deterministic Zcash contract/helper suite: 12 passed
• py_compile for the changed client and generated binding: passed
• working tree diff check: passed

Stack

Base: reconcile/upstream-sync.

Protocol dependency: keepkey/device-protocol#113 (f2246ce). This PR deliberately pins that exact upstream commit so python-keepkey and firmware test the same wire contract.