docs: full reflection of skill v0.6.0 + MCP companion in README + SECURITY

README:
- Broaden agent-side hardening list to include all skill v0.6.0
  invariants (#1.a outer dispatch-target / #2.5 chain-naming / #6b
  Tier-1 facet decoder / #11 approval-class / #12.5 hard-trigger /
  #14 set-level intent / #15 durable-binding / et al)
- Expand security-model paragraph with the new defense classes the
  skill enforces beyond the server-emitted block prose

SECURITY.md:
- Add 6 new defenses-table rows: Inv #1.a (outer dispatch-target
  allowlist), #2.5 (chain-must-be-explicit), #6b (Tier-1 facet
  decoder), #12.5 (mandatory second-LLM hard-trigger), #14 (set-level
  intent verification), #15 (durable-binding source-of-truth)
- Update preflight-skill row to enumerate the full v0.6.0 invariant
  set + current sentinel `_v8_4aac027a9df315a9`
- Update version refs (v0.4.1 → v0.6.0) in asymmetry section + add
  pointer to the new "Adversarial smoke-test 2026-04-28" subsection
- Add 7 new threat-mapping bullets covering the v0.6.0 attack classes:
  recipient substitution via stale approval, cross-chain ambiguity /
  CREATE2 sweeper, bridge facet recipient swap, reverse-revoke /
  set-level lie, durable-binding selection-layer, free-form drainer
  pattern, EIP-7702 setCode (forward-looking)
- Expand "Phishing approvals" with v0.6.0 broadening (Inv #1.a closes
  recipient redirection; Inv #14 closes reverse-revoke)
- Expand "Free-form message signing" with §8 hardening (byte
  fingerprint, drainer-template refusal, why marker-word-only is
  wrong)
- New "Selection-layer attacks" section explaining the threat class
  Inv #15 introduces (validators / SRs / Comets / marketIds / banks
  / ATAs / LP tokenIds / multisig xpubs)
- New "Forward-looking invariants" section for #1b/#2b (typed-data,
  ships when MCP surface lands) + §16 (EIP-7702 refuse-all)
- New "Adversarial smoke-test 2026-04-28" subsection summarizing the
  44-script corpus + 7-of-8 sub-issue closure + 3 follow-up tracking
  issues (#481 7702 builder + skill v9, #482 per-EVM-chain contact
  tag, #483 per-handler dispatch-target wiring)

Pure docs — no behavior change.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: szhygulin

README.md

@@ -41,11 +41,11 @@ This is an agent-driven portfolio management tool, not a wallet replacement. The
 user-intent ──► agent ──► MCP server ──► WalletConnect / USB-HID ──► Ledger Live / host ──► Ledger device
 ```
 
-Layered defenses catch most single-layer compromises: a server-side prepare↔send fingerprint, an independent 4byte.directory selector check, agent-side ABI decode + pre-sign hash recomputation, on-device clear-sign or blind-sign-hash match, a WalletConnect session-topic cross-check, a `previewToken`/`userDecision` gate, and — for skeptical users on high-value flows — a `get_verification_artifact` that routes bytes to an independent second LLM. **See [SECURITY.md](./SECURITY.md)** for the full defenses table, threat mapping, honest limits, and verification recipes.
+Layered defenses catch most single-layer compromises: a server-side prepare↔send fingerprint, an independent 4byte.directory selector check, agent-side ABI decode + pre-sign hash recomputation, on-device clear-sign or blind-sign-hash match, a WalletConnect session-topic cross-check, a `previewToken`/`userDecision` gate, and — for skeptical users on high-value flows — a `get_verification_artifact` that routes bytes to an independent second LLM. The companion `vaultpilot-security-skill` (see Agent-side hardening below) extends this with agent-side invariants the server cannot omit: outer dispatch-target allowlist, chain-must-be-explicit refusal, Tier-1 bridge facet decoder, set-level intent verification on revoke flows, durable-binding source-of-truth verification on validator / market / LP / xpub selection, byte-fingerprint preview + drainer-template refusal on `sign_message_btc/_ltc`, and mandatory second-LLM cross-check on hard-trigger ops. **See [SECURITY.md](./SECURITY.md)** for the full defenses table, threat mapping, honest limits, and verification recipes.
 
 ### Agent-side hardening (strongly recommended)
 
-The `CHECKS PERFORMED` / `VERIFY-BEFORE-SIGNING` directives VaultPilot emits are authored by the MCP server itself — a compromised server could silently omit them. Install the companion [`vaultpilot-security-skill`](https://github.com/szhygulin/vaultpilot-security-skill) so the agent runs the bytes-decode + hash-recompute invariants regardless of what the MCP says:
+The `CHECKS PERFORMED` / `VERIFY-BEFORE-SIGNING` directives VaultPilot emits are authored by the MCP server itself — a compromised server could silently omit them. Install the companion [`vaultpilot-security-skill`](https://github.com/szhygulin/vaultpilot-security-skill) so the agent runs its cryptographic integrity invariants on every signing flow regardless of what the MCP says — bytes decode (#1) + outer dispatch-target allowlist (#1.a) + hash recompute (#2) + chain-must-be-explicit refusal (#2.5) + bridge-recipient cross-check (#6b) + approval-class surfacing (#11) + mandatory second-LLM on hard-trigger ops (#12.5) + set-level intent verification (#14) + durable-binding source-of-truth (#15):
 
 ```bash
 git clone https://github.com/szhygulin/vaultpilot-security-skill.git \