feat(pair_ledger): mandate per-address device verification in instructions

[szhygulin]

Closes #577.

Summary

Update the runtime instructions field of every pair_ledger_* tool (btc, ltc, tron, solana, live) to mandate that the cooperating agent surface the FULL paired address (no truncation) and force the user to verify it character-by-character against the device's address-display screen before any subsequent prepare_* / send_transaction may consume the paired address.

Threat / scope split

Threat: rogue MCP returns an attacker-controlled address from pair_ledger_*. Caught in matrix-sampled smoke-test batch-3 (newcomer-n192-C.2).

Why this is mostly a skill-side fix: the actual rogue-MCP defense is the user reading the Ledger device screen (out-of-band trust anchor outside the MCP boundary) and typing back chars to the agent. A rogue MCP fabricates both the address and any "verification proof" it might emit — MCP-side advisory text alone is structurally circular under rogue-MCP per the project's tautological-mitigation rule. The binding rule has to live skill-side so a cooperating agent drives the user-verification flow even when the MCP omits the advisory.

This MCP-side change is defense-in-depth for the cooperating-MCP case. The skill-side companion is filed at vaultpilot-security-skill#42 with the full Inv #18 rule (force user echo-back of first 6 + last 6 chars from device, refuse on mismatch) and an explicit cooperating-agent scope statement. Together they cover Role-B (rogue-MCP + cooperating agent); rogue-agent remains an architectural gap per the Rogue-Agent-Only Triage rule (skill text is in agent context — a hostile agent ignores it).

Pre-sign gate sweep

Per the project's surface-sweep rule, this change does not modify any assertTransactionSafe block. It only adds advisory text to pair_ledger_* runtime responses. No prepare_* paths are gated.

Regression test

test/security-audit.test.ts (mirrors the existing Connected Apps topic-cross-check pattern):

• ≥5 occurrences of VERIFY BEFORE FIRST USE (one per pair_ledger_*)
• ≥5 occurrences of FULL string|address
• ≥5 occurrences of On any mismatch, abort

A future "address paired, you can now send" softening fails CI loudly.

What is intentionally NOT in scope

• No display=true on USB pair calls. Adding it would force a device prompt at pair time, but a rogue MCP just doesn't pass display=true — UX cost without rogue-MCP benefit. Skipped.
• No structured verificationRequired: true field. Same tautological-mitigation argument: rogue MCP omits it. Plain text in the instructions field is enough for the cooperating-MCP case the skill-side rule already covers more rigorously.
• No state machine gating subsequent prepare_* calls. A rogue MCP doesn't enforce the gate on itself. The agent-bound enforcement lives skill-side.

Test plan

• npm run build (tsc, no errors)
• npm test (2559 / 2559 tests pass)
• Manual: pair_ledger_btc against a real device — confirm the new instructions text surfaces in the response
• Smoke-test re-run of newcomer-n192-C.2 — confirm the verification mandate is what the agent surfaces (cooperating-agent regression check)

— Rogue-MCP Trust Boundary (agent-5ade)