chore(release): minor-bump wallet-toolbox 2.4.0 for GHSA-36f9-7rg5-cpf8 fix

wallet-toolbox, wallet-toolbox-client, and wallet-toolbox-mobile bumped in
lockstep to publish the storage output-verification security fix.

Author: sirdeggen

packages/wallet/wallet-toolbox/CHANGELOG.md

@@ -6,6 +6,8 @@ attention to changes that materially alter behavior or extend functionality.
 
 ## wallet-toolbox (unreleased)
 
+- Release prep for `2.4.0`: security fix for `GHSA-36f9-7rg5-cpf8`. `buildSignableTransaction` now verifies that storage-returned outputs match the caller's requested `args.outputs` before signing (rejects substituted/altered/reclassified/missing outputs), and rejects any unrequested output that isn't client-derived change or a single commission output bounded by `MAX_STORAGE_COMMISSION_SATOSHIS`. `WalletPermissionsManager.createAction` independently verifies requested outputs are present in the signable transaction before authorizing, as defense-in-depth. Protects against a malicious or compromised `StorageClient` operator substituting or injecting outputs that would be signed and broadcast without the caller's knowledge.
+
 - Release prep for `2.3.3`: add Arcade-first wallet service wiring, go-chaintracks
   live client/SSE support, resilient ARC/Arcade status handling, monitor
   rebroadcast safeguards, and callback-token redaction for Arcade SSE logs.

packages/wallet/wallet-toolbox/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox-client",
-  "version": "2.3.3",
+  "version": "2.4.0",
   "description": "Client only Wallet Storage",
   "main": "./out/src/index.client.js",
   "types": "./out/src/index.client.d.ts",

packages/wallet/wallet-toolbox/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox-mobile",
-  "version": "2.3.3",
+  "version": "2.4.0",
   "description": "Client only Wallet Storage",
   "main": "./out/src/index.mobile.js",
   "types": "./out/src/index.mobile.d.ts",

packages/wallet/wallet-toolbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox",
-  "version": "2.3.3",
+  "version": "2.4.0",
   "description": "BRC100 conforming wallet, wallet storage and wallet signer components",
   "main": "./out/src/index.js",
   "types": "./out/src/index.d.ts",