What is in scope

Anything that breaks an invariant in docs/THREAT-MODEL.md. The ones we care about most:

• key material leaving the daemon process, in any form, including in an error message or a log line
• a signature that is not byte-for-byte reproducible from the seed and the PSBT
• a PSBT that signs without matching a registered descriptor
• an output the signing screen shows as change ("Change, re-derived at ... Verified against your seed") that is not provably ours
• any code path that can reach a non-loopback address
• a build that verifies against MANIFEST.lock but does not match its sources
• once hidden profiles exist (planned for phase 7, not built), a way to distinguish, from outside, how many profiles a store holds, or whether a given PIN attempt hit a real slot