Pin nonce+EIP-1559 fees at send; surface pre-sign hash (#37)

[szhygulin]

Summary

• Closes Scope: pin gas + expose pre-sign RLP hash for on-device match in blind-sign mode #37. Pins nonce, maxFeePerGas, maxPriorityFeePerGas, and gasLimit server-side at SEND time (not prepare — gas moves), forwards them through WalletConnect's eth_sendTransaction, and computes the EIP-1559 pre-sign RLP hash that Ledger displays in blind-sign mode.
• Emits a new LEDGER BLIND-SIGN HASH — RELAY VERBATIM TO USER; THEY MATCH ON-DEVICE content block on every EVM send_transaction, with an explicit load-bearing warning that tapping "Edit gas" / "Edit fees" in Ledger Live legitimately desyncs the hash (reject on-device, re-run).
• Restores on-device calldata integrity in blind-sign mode — before this, PR Add verifiable transaction preview (swiss-knife + payload-hash proof) #35 correctly dropped the bogus "match short hash" reminder, but that left the user with only To + Value checks on-device for any tx that didn't clear-sign.
• RPC failure during the pin throws — no silent fallback to unpinned, because unpinned defeats the purpose of emitting a hash.
• Rewrote renderAgentTaskBlock's final Ledger reminder to point at the send-time block as authoritative; updated TRANSACTION VERIFICATION and added LEDGER BLIND-SIGN HASH paragraphs to the server-level instructions.

Approach

• New helper eip1559PreSignHash in src/signing/verification.ts via viem's serializeTransaction({type:"eip1559", ...}) + keccak256. Golden cross-check in tests against a viem-independent re-serialize to catch shape drift.
• requestSendTransaction in src/signing/walletconnect.ts gained a PinnedGasFields arg; when present, all four fields are hex-encoded in the RPC params. Legacy tx.gasEstimate fallback kept for any caller that doesn't pin.
• sendTransaction in src/modules/execution/index.ts fetches pending getTransactionCount, estimateFeesPerGas, and estimateGas in parallel just before the WC request; returns {preSignHash, pinned, to, valueWei} so the handler can emit the block without re-reading the consumed handle.
• sendTransactionHandler in src/index.ts splices the new block between the JSON result and renderPostSendPollBlock.

Caveats & acceptance-criterion follow-up

• Empirical Ledger Live test still required — the issue flags that Ledger Live may treat dApp-supplied fee fields as hints and fall back to its own estimator when it judges them stale. Needs a tiny live prepare_native_send + send_transaction on mainnet/testnet to confirm it honors all four pinned fields (or document which ones it silently overrides). I can run this at your direction; if any field turns out to be overridden, we'd scope the pin down in a follow-up PR before relying on the hash match in docs.
• Stale-nonce races — if the user has a pending tx in mempool between our nonce read and the actual sign, the pin is stale. Ledger Live likely refetches silently; same Edit-gas warning covers the symptom (hash mismatch → reject → retry).
• Threat model — defense-in-depth only. A compromised Ledger Live ignores the pin entirely; a compromised MCP could lie about the hash too. The cross-channel check remains the local-ABI + 4byte.directory decode that already ships.

Test plan

• npx tsc --noEmit
• npx vitest run — 399/399 passing (added test/send-hash-pin.test.ts for the golden hash, pinned-field propagation, RPC-failure-throws path; updated test/simulation.test.ts forward-test to assert the pin reaches WC)
• Live Ledger Live round-trip on a tiny native send: confirm the on-device hash matches the emitted block in blind-sign, confirm the Edit-gas path triggers a legitimate mismatch
• Session smoke test: orchestrator relays the new block verbatim (it's a user-facing block, not agent-task) and does not collapse it into a bullet summary

🤖 Generated with Claude Code