test(insight): activate clear-signing tests on 7.15.0 + expand report SECTIONS

The feature ships in the 7.15.0 firmware tree, so gate the device tests at
7.15.0 (was 7.15.1, which left them dormant on the current build).

- test setUp: requires_firmware 7.15.1 -> 7.15.0.
- generate-test-report.py SECTIONS 'V' (EVM Clear-Signing) min_firmware
  7.15.1 -> 7.15.0; add V9-V12 mapping the new device-class tests
  (full tx-hash binding happy path, replay reject, AdvancedMode gate,
  cancel-clears-metadata) with OLED screenshot expectations so the
  report-driven Phase-1 capture includes them.

Verified on the containerized kkemu emulator (docker compose, CI-faithful):
all 28 clear-signing tests pass; OLED screenshots captured for the verified
flow (INSIGHT VERIFIED icon + decoded method/contract/args), the replay
reject, and the AdvancedMode gate.

Author: BitHighlander

scripts/generate-test-report.py

@@ -785,14 +785,15 @@ def parse_junit(path):
        [])]),
 
     # ===== 7.15.1 NEW FEATURES =====
-    ('V', 'EVM Clear-Signing', '7.15.1',
+    ('V', 'EVM Clear-Signing', '7.15.0',
      'NEW: Verified transaction metadata for EVM contracts. Host sends a signed blob with contract '
      'name, function, and decoded parameters. Device verifies blob signature against trusted key, '
-     'then shows human-readable details with VERIFIED icon. Blind-sign policy gating ships with '
-     'firmware 7.15.1+.',
+     'then shows human-readable details with VERIFIED icon. The signature is bound to the full tx '
+     'hash, and AdvancedMode is the single blind-sign gate (off = reject unknown contract data).',
      [
          'CLEAR-SIGN: Signed metadata -> verify signature -> VERIFIED icon + method + decoded args',
-         'BLIND SIGN: No metadata + AdvancedMode on -> contract data signed after policy gate',
+         'BINDING: metadata committed to tx A, signing tx B is refused at send_signature',
+         'BLIND SIGN: No metadata + AdvancedMode off -> unknown contract data hard-rejected',
      ],
      [
          ('V1', 'test_msg_ethereum_clear_signing', 'test_valid_metadata_returns_verified',
@@ -817,7 +818,27 @@ def parse_junit(path):
          ('V8', 'test_msg_ethereum_signtx', 'test_ethereum_blind_sign_allowed',
           'Blind sign permitted (AdvancedMode ON)',
           'Contract data with AdvancedMode enabled. Device allows signing. '
-          'Blind-sign policy gating covered in 7.15.1+.',
+          'Blind-sign policy gating covered in 7.15.0+.',
+          []),
+         ('V9', 'test_msg_ethereum_clear_signing', 'test_binding_happy_path_signs_and_recovers',
+          'Full tx-hash binding (happy path)',
+          'Metadata tx_hash = the real sighash of the EthereumSignTx. Device shows the verified '
+          'decoded screens, signs, and the signature recovers to the device signer.',
+          ['VERIFIED icon + method', 'Decoded contract + args']),
+         ('V10', 'test_msg_ethereum_clear_signing', 'test_replay_rejected_when_digest_differs',
+          'Replay reject (binding enforced)',
+          'Metadata committed to tx A; signing tx B (same contract/selector/chain, different '
+          'calldata) is refused at send_signature with "Metadata does not match signed transaction".',
+          ['Verified screen then reject']),
+         ('V11', 'test_msg_ethereum_clear_signing', 'test_advanced_mode_gate',
+          'AdvancedMode blind-sign gate',
+          'AdvancedMode OFF + unknown contract + no metadata is hard-rejected; ON signs; a '
+          'natively-decoded ERC-20 transfer is unaffected.',
+          ['Blind sign disabled (Blocked)']),
+         ('V12', 'test_msg_ethereum_clear_signing', 'test_cancel_clears_metadata_not_reused',
+          'Cancel clears metadata (no stale reuse)',
+          'Cancelling the verified confirm clears the blob; a later matching tx is not silently '
+          'signed with the stale metadata.',
           []),
      ]),
 

tests/test_msg_ethereum_clear_signing.py

@@ -504,7 +504,7 @@ class TestEthereumClearSigning(common.KeepKeyTest):
 
     def setUp(self):
         super().setUp()
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         self.requires_message("EthereumTxMetadata")
         self.setup_mnemonic_nopin_nopassphrase()