[Jainakin]

Add Bitcoin-address BIP-322 simple signing alongside the existing Lightning node-identity API. An unlocked node with its matching native signer can prove control of its canonical first vanilla BIP86 Taproot address. Exact UTF-8, including empty messages, whitespace and NUL, is preserved. Signing emits finalized smp proofs; offline verification supports strict P2TR key-path and P2WPKH simple forms.

Native changes live entirely in this binding's checksum-pinned overlay against RLN v0.17.0-beta.3. Each proof checks the live unlocked wallet identity and persisted bootstrap against the attached native signer. Shutdown drains active calls and revokes the added address key across retained clones. No upstream repository or published version changes. The maintained adapter also refuses unsafe VSS configuration and backup/fence operations before native runtime, filesystem or transport creation.

API: getMessageSigningAddress(), signMessageBip322(message, address), node verifyMessageBip322(message, address, signature), and pure module verifyMessageBip322(message, address, signature, network). The compiled capability is bip322-simple-v1; legacy signMessage() retains its existing semantics. See BIP322.md for supported scripts, fixed-address scope, custody boundaries and pinned primary specification/vector sources.

VSS safety boundary

Any supplied VSS URL string, including empty/malformed values, fails with sanitized ERR_VSS_UNSAFE_UPSTREAM before storage or networking. Instance, raw and compatibility-global paths share the same native guard. Backup and fence clearing reject on existing local-only handles without mutating storage. Omitted/null native configuration retains local-only operation. Compiled vss-safety-policy-v1 metadata explicitly reports unsupported; no unsafe override, scheduler, new credential protocol or automatic fence deletion exists. This contains the unsafe integration and does not repair remote archives or upstream backup/recovery defects. See VSS-SAFETY.md.

Exact source and validation

Shared adapter: d8b5be9809b12acd48fa5958014b4655ff94598c99800a2fafb9e3e81809aebf. RLN ecc69f2, rgb-lib 1b951af and LDK 79b9eb5 remain unchanged.

• 99 JS tests, 17 distribution/refusal tests, TypeScript checks, three exact-overlay Rust BIP-322 vector/adversarial groups and 17 native UniFFI lifecycle/ownership tests passed.
• All four Apple Release artifacts rebuilt from c1994daf1d14a4dfd37846f9f91915f357aa7b4b and passed full source/hash/symbol admission together: Darwin ARM64, iOS ARM64 device, iOS ARM64 simulator and iOS x64 simulator. Existing main split-distribution and Android staging contracts are preserved.
• GitHub contract and Android staging checks passed. No new Android native binary or Android runtime qualification is claimed.
• Actual Bare 1.33.4 and Node 22.23.3 Release host runtimes each passed 180 configured-VSS denial cases across facade/raw/global paths, zero accepted HTTP/TCP connections and unchanged/absent storage assertions. Each passed two unlock/shutdown/reopen cycles, official/adversarial BIP-322 vectors and eight freshly emitted public proofs independently verified with scure+noble.
• The exact packed WDK/Node consumer passed local creation/reopen, BTC/BFA reads, public BFA contract import and six independently verified proofs. Twelve configured-VSS cases rejected without native writer or HTTP requests.
• Iris on iOS 27 Debug passed fresh local creation, unavailable backup states, native PIN authorization, an independently verified empty-message proof and cold unlock/reopen. Configured VSS was blocked with zero HTTP requests and 11 wallet files byte-identical; seed import made no complete-recovery claim. Iris policy/evidence.

These are local containment and signing checks; they do not establish funded transfer, physical-device, Android runtime, public VSS, remote recovery/erasure or arbitrary crash-recovery qualification. Existing registry beta.4 artifacts do not contain this source extension. This PR remains draft; no merge or publication.