fix(confirm): stop review() reporting success when the host took the screen away

[BitHighlander]

#428(a) only. Deliberately does not attempt #428(b).

The defect

All four review*() variants called confirm_helper() as (void) and then return true:

  (void)confirm_helper(request_title, strbuf, &layout_standard_notification,
                       false, NO_ICON, false);
  memzero(strbuf, sizeof(strbuf));
  return true;

This device has one button and no reject, so confirm_helper() returns false for exactly one reason: a host-sent Cancel/Initialize. Discarding it means a host can suppress a screen and still be told the review happened.

Where it actually costs something

Propagating is one line per variant. What matters is the single caller where the operation continued afterwards.

passphrase_sm.c:146 — the "passphrase confirmation" screen is the only place a user sees the passphrase their keys will be derived from. passphrase_request() ignored the result and set ret = true, so a host answering that screen with a Cancel suppressed the display and still reached session_cachePassphrase() (passphrase_sm.c:187). The session then derives a different wallet than the user believes they are opening, with nothing shown on the OLED.

All five callers of passphrase_protect() already test its result (storage.c:1863,1886,1932, fsm_msg_common.h:171,312), and each responds with Failure_ActionCancelled. So returning the review's verdict is sufficient — no caller changes.

The other ten sites, audited

None has the same consequence, and each was checked rather than assumed:

site	what follows	effect of suppression
fsm_msg_ton.h:108,182, fsm_msg_solana.h:485, ethereum.c:809	fsm_sendFailure + abort	hides an explanation for a refusal that happens anyway
transaction.c:456	retval = -1	transaction refused either way
recovery_cipher.c:604,608,614	matching Success/Failure	dry run; nothing signed, no state change
authenticator.c:257,264	OTP display	gates/annotates a display

They now receive a meaningful value instead of an unconditional true, which is worth having even where today's consequence is nil.

Coverage gap, stated deliberately

There is no automated test for this. review() drives confirm_screen()'s loop, which blocks on a button press or an injected USB tiny-message, and no unit test in this tree sets that up — the confirm-driver suites are precisely why firmware-unit does not complete unfiltered.

The test belongs in the python-keepkey integration suite, which can send PassphraseAck then Cancel and assert the passphrase is not cached. That suite is pinned to a commit predating this work (see the repin blocker in the release notes). Until then this rests on reading, the ARM build, and the hardware round.

Scope

Closes the suppression primitive in #428. Does not close #428 — the render measurement still covers only layout_standard_notification, so the custom-layout address and xpub screens remain outside the measured guarantee. Gate 2 stays formally unmet, and the release notes should not say otherwise.

Verified

ARM cross-compile in the pinned builder image; cppcheck clean under CI's exact invocation (0 findings); clang-format clean across CI's entire lint scope.

Depends on #474 for a usable CI signal — secret-scan is currently red repo-wide from an unpinned gitleaks, which skips the whole build graph.