fix(security): second-LLM check is always optional

[szhygulin]

The second-LLM cross-check is always optional. Inv #12.5 (issue #501 / #530) had carved out a set of op classes where it was a precondition of send; that carve-out is gone.

MCP side (this PR). Deletes secondLlmRequired on UnsignedTx and the ⚠ SECOND-LLM CHECK REQUIRED line renderVerificationBlock emitted for it. No prepare_* path ever set the flag, so no shipped behavior changes — the deletion removes the only mechanism by which one could. SECURITY.md / README.md / ROADMAP.md restate Inv #12.5 as a recommendation.

Why optional. The check needs the user to physically paste into a second provider's session, so a rule that blocks send until it happens blocks the user, not an attacker — a rogue agent self-attests the verdict either way (the userDecision: "send" self-attestation gap). Users who run it still get the value: a coordinated lie across two provider sessions is harder than a single-agent compromise.

Test. test/second-llm-required-flag.test.ts (the flag's test) is replaced by test/second-llm-always-optional.test.ts, which pins the policy instead: no renderer output attaches REQUIRED|MANDATORY|MUST|NOT YET RUN to a SECOND-LLM line, and the offer stays present and labeled optional on both sign modes. Verified red by re-adding a mandatory line to renderVerificationBlock (1 failed at second-llm-always-optional.test.ts:61), then restored.

Out of scope — the load-bearing gate is skill-side. SKILL.md §12.5 refuses to advance to preview_send / send_transaction until the user supplies a second-LLM verdict, and lists prepare_custom_call as a trigger. Filed at szhygulin/vaultpilot-security-skill#51. That issue also covers §12.5's claim of an MCP-side secondLlmRequired = true auto-stamp, which was never implemented and after this PR names a field that no longer exists.

test-results/SUMMARY.md still records "mandatory second-LLM, not opt-in" as a 2026-04-28 smoke-test recommendation; left as written — it is a dated record, not live policy.

Gate: tsc --noEmit clean; vitest run test/second-llm-always-optional.test.ts test/verification.test.ts test/send-hash-pin.test.ts → 101 passed.

Reverses the MCP half of #501 (shipped in #530). #501 is already closed; this does not reopen it.

Based on agenthill/main @ 50f82e5; the szhygulin fork PR opened first was closed (stale downstream, 56 behind).

🤖 Generated with Claude Code