test(atlas): catalogue the four 7.15 areas the report could not see - #33

The PDF report is generated from SECTIONS, and the screenshot filter is derived
from the same list — so a test that is not in SECTIONS is captured by nothing and
appears nowhere. Four things a 7.15 audit needs were in exactly that state.

NEW SECTIONS, all min_fw 7.15.0 so a 7.14.x report is unchanged (verified: at
7.14.2 the active set stays 18 sections and none of F/I/L/U appear; at 7.15.0 it
is 26 and all four do):

  F  Clear-Sign Provider Context - Additive Invariant   5 tests
  I  Session and Trust Lifetime                         6 tests
  L  Bitcoin-Only Variant                              11 tests
  U  Storage Upgrade Preservation                       8 tests

THE HEADLINE RESULT: the additive invariant HOLDS, measured on device rather
than argued from code. Aave supply() baseline is 3 screens; a VERIFIED v1 decode
is 10 screens with those same 3 baseline frames BYTE-IDENTICAL at the tail; the
v2 static-schema path is 13 with the same tail; a payload whose signature fails
verification draws 3 frames byte-identical to the baseline — it neither refuses
nor leaks partial decoded information. All four runtime slots behave identically,
and no slot verifies without a runtime load, so the suppression branch has no
reachable input on this build.

A trap worth recording, because it would have made the section look right while
proving nothing: for a RECOGNIZED ERC-20 the baseline has no raw-calldata screen
at all — ethereum.c's token path skips it before clear-signing is consulted. A
v2 test written against a USDC transfer would appear to prove "the raw review
survives" when there was no raw review to survive. Section F deliberately uses
the unrecognized Aave supply() fixture instead.

The three additive tests are added to FULL_SEQUENCE_TESTS: the claim is about
ORDER (decoded screens, then the baseline), so a best-of-3 frame sample would
hide the very thing being proved.

Also fixes two colliding section letters that made the report ambiguous: two
sections emitted 'S' ids (Display Binding and Solana) and two emitted 'D'
(BIP-85 and Display Disclosure), so distinct tests shared a label. The two
disclosure sections are renamed to J and Q — safe because they post-date the pyk
revision every published report was built from, whereas renaming Solana or
BIP-85 would break existing evidence references.

Requires keepkey-firmware PR #495. Two of the eleven bitcoin-only tests fail
without it, and both failures are real firmware defects that this suite found:
an OP_RETURN output poisoning the duplicate-transaction detector (affects BOTH
products), and variant_getName() reporting "Emulator" for a bitcoin-only build
so requires_fullFeature() never skipped anything.