feat(templates): add R1-K1 hardware wallet contract

[sirdeggen]

Program and scope

• Tracker or issue: Runar contract PR icellan/runar#152
• Program gate(s) advanced: Static, consumable ScriptTemplate for the cross-language R1-K1 contract.
• Why this change is needed: Enables normal P-256 signing with a non-exportable YubiKey PIV key, salted per output for pre-spend unlinkability, with an independent mnemonic-derived secp256k1 recovery key.
• Explicitly out of scope: YubiKey transport/APDU integration, mnemonic custody, miner policy changes, and npm publication.
• Exact head SHA reviewed: a2264acf7239bed980104080f4864fc8fc80fba8

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected package: @bsv/templates 1.9.6 -> 1.10.0 (minor; additive API).

Verification

• Local: 16 suites / 116 tests passed; lint, formatting, typecheck, build, browser consumer, packed consumer, generated docs, and root formatting passed.
• Hosted CI run: CI 31840779966, CodeQL, SonarCloud, Socket, and conformance are terminal and successful on the exact head.
• Conformance evidence: Decompressed artifact is byte-identical to Runar's 959,592-byte expected-script.hex; full interpreter spends pass for real P-256 and secp256k1 signatures.
• Coverage delta: Eleven focused R1K1/export tests cover construction, DER hardware signing, both real spend paths, commitment failures, and whole-script tampering. Local replay of the repository patch gate passes at 94.24% (180/191); hosted confirmation pending.
• Lint/typecheck delta: Zero local findings.
• Browser/mobile/packed-consumer evidence: Vite 199,678 raw / 64,561 gzip / 53,362 Brotli; esbuild 165,308 raw / 62,045 gzip / 52,037 Brotli; within existing budgets. ESM/CJS, declarations, exports, source maps, publint, and clean consumers passed.
• Performance or bundle-size delta: Bytecode is gzip-compressed and lazily decompressed. Baked locking script is intentionally 959,632 bytes and documented as exceeding common 500 KB miner policy.
• I self-reviewed the complete diff for correctness, security,
  compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any
  scope-based skip is expected and validated by the merge gate

The local repository-wide health wrapper traversed unrelated pre-existing .worktrees/* checkouts and reported their stale policy files. Its package, documentation, and governance checks passed; hosted CI uses a clean checkout.

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

The signer verifies the complete compiled script and commitments before invoking hardware. PIV receives the final BIP-143 digest unchanged. Documentation explains that PIN/touch does not provide a trusted transaction display. pnpm audit --audit-level=high reported two existing ignored high advisories; this PR changes no dependency or lockfile.

Dependency evidence

No dependency change. Existing Node >=22 and browser profiles passed; lockfile is unchanged; bundle remains within budget; affected version is @bsv/templates@1.10.0.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

No image or deployment impact. Artifact provenance includes the exact Runar source commit and checksum.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code, passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is being handed to another contributor as complete
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sirdeggen]

Only adds new code, nothing potentially destructive to others. Merging.