fix(bitcoin-only): identify physical firmware to Vault

[BitHighlander]

Release blockers closed

The physical KK_BITCOIN_ONLY artifact at PR #534 head b67e535 did not embed or report KeepKeyBTC. Vault therefore treated real hardware as the ordinary multi-chain variant. Separately, CI never ran Python integration against the Bitcoin-only emulator despite the SRS claiming 11/11.

Fix

• physical Bitcoin-only Features reports KeepKeyBTC; emulator remains EmulatorBTC
• CI and tagged release builds inspect the actual ARM artifact: marker required in Bitcoin-only, forbidden in full
• ARM ELF must retain core Bitcoin handlers and contain no non-Bitcoin message handlers
• a native Bitcoin-only test pins BITCOIN_ONLY=1, ZCASH_PRIVACY=0, TOKENS_COUNT=0, the exact Bitcoin/Testnet coin table, and EmulatorBTC identity
• Python integration now has a real Bitcoin-only emulator leg

Local proof

• old b67e535 Bitcoin-only artifact is rejected by the identity gate
• its ELF passes the new handler-surface policy
• previous Bitcoin-only unit log was audited: 78 firmware + 13 board + 18 crypto tests ran, but no Python integration leg existed
• helper syntax, clang-format, YAML parse, Compose argument expansion, and diff check passed

This is stacked on #534 and must land before physical Bitcoin-only app acceptance.