identity: clean temporary hash buffer

What changed, and why it matters

This commit fixes a small but real security hygiene issue in Blockstream Jade, a hardware wallet. A temporary buffer that holds a sensitive cryptographic hash (HMAC-SHA512 output used to derive child private keys) was not marked as sensitive memory. That means the buffer could be left uncleared in RAM after use, potentially leaking key material if an attacker could read device memory. The patch marks the buffer with SENSITIVE_PUSH so it is properly wiped with SENSITIVE_POP. It is a cleanup/fix, not a full exploit chain by itself.

Security signals we found

Evidence from the diff

Changed components

### main/identity.c
@@ -107,6 +107,7 @@ static void get_bip32_hardened_child(
 
     // I = HMAC-SHA512(Key = cpar, Data)
     uint8_t sha[HMAC_SHA512_LEN];
+    SENSITIVE_PUSH(sha, sizeof(sha));
     JADE_WALLY_VERIFY(wally_hmac_sha512(parent->chain_code, sizeof(parent->chain_code), child_out->priv_key,
         sizeof(child_out->priv_key) + sizeof(child_out->child_num), sha, sizeof(sha)));
 
@@ -137,6 +138,7 @@ static void get_bip32_hardened_child(
     SENSITIVE_POP(&tmp);
     SENSITIVE_POP(&tweak);
     SENSITIVE_POP(&key);
+    SENSITIVE_POP(sha);
 
     child_out->version = BIP32_VER_MAIN_PRIVATE;
 }