feat(security): UnsignedTx.secondLlmRequired scaffold for Inv #12.5 (#501)

[szhygulin]

Closes #501.

Summary

Inv #12.5 (skill-side) marks a curated list of op classes where the second-LLM check is a precondition of `confirmed: true`, not opt-in. The skill rule lives in `vaultpilot-skill` v9+; this PR is the MCP-side scaffold so future hard-trigger op producers can flip a flag at build time and have the existing verification block surface a mandatory ⚠ line.

What ships

• New `secondLlmRequired?: boolean` on `UnsignedTx`. Default absent / false.
• `renderVerificationBlock` emits a ⚠ line below the hash when the flag is true: `⚠ SECOND-LLM CHECK REQUIRED — call get_verification_artifact(handle) and relay the pasteableBlock to the user BEFORE 'send' (Inv Auto-discover Morpho Blue positions via event-log scan #12.5 hard-trigger op).`
• +3 tests pinning the behavior (omitted when absent/false, emitted when true, composes cleanly with recipient + `tokenClass` warnings).

What does NOT ship

No producer wires the flag yet — every hard-trigger op class is itself deferred (#481 EIP-7702, #453 Permit2 batch, #451 opaque-facet bridges, Safe enableModule / N-candidate selection not yet built). Pure dormant scaffold.

Trust note (documented inline)

The flag is a workflow signal, not a cryptographic primitive. Closing the agent-side honesty gap (rogue agent ignores or self-attests the check) requires infrastructure that doesn't exist today:

Approach	Feasibility	Why not today
Provider-signed responses (Anthropic / OpenAI sign verdicts with provider key)	Easiest, just needs vendor buy-in	No API today exposes signed responses
TEE attestation (run second LLM in SGX / SEV / PCC)	Works	Heavy infra; defeats vendor-diversity intent
zkML proof of NN inference	Works in research	Hours-to-days proving on small models
Challenge-response (MCP asks, user pastes answer back)	Naive — doesn't help	MCP knows the answer; rogue agent answers correctly without involving a second LLM
Out-of-band human ack (SMS / hardware confirm button)	Works for "human approved"	Doesn't prove an LLM verified

Coordinated release

• Skill v9 (in `vaultpilot-skill` repo) ships the Inv Auto-discover Morpho Blue positions via event-log scan #12.5 invariant text + lifts §16 unconditional 7702 refusal.
• MCP-side `EXPECTED_SKILL_SHA256` bump happens in that skill-coordination PR, not this one — this PR is just the dormant scaffold.

Test plan

• +3 tests, full suite 2447/2447 passing
• Verify CI green
• Smoke (when first hard-trigger op producer ships): `prepare_` → receipt verification block contains the `⚠ SECOND-LLM CHECK REQUIRED` line below the hash.

🤖 Generated with Claude Code