fix(wallet-toolbox): encrypt internalizeAction customInstructions once

[sirdeggen]

Fixes #785.

Program and scope

With metadata encryption enabled, a normal-basket insertion was encrypted before permission modules and again afterward when a registered p label or basket caused modules to run. This PR keeps the original fix: the after-module pass encrypts only permission-module baskets, so normal-basket instructions retain their existing single layer.

• Original implementation and both PR test files are byte-identical to 81c0e0792f136975f6c5d3a87b99f3605c8de342.
• Current main at be2a2e7ade2eb8487b08d4d2b158f02ab36a3160 is merged. Conflicts were limited to release notes, the changelog and the generated migration ledger; both sets of notes are preserved.
• Existing double-encrypted records, read behavior, createAction, and trusted-module transformations remain outside this fix. No encryption-history tracking or automatic legacy recovery is added.
• Exact head: 4c69a2c33016ea443cdaff6941ed7c68d31bdb5e.

Impact

• Public package source changed: @bsv/wallet-toolbox, with shared browser/mobile implementation
• Security-sensitive metadata behavior changed
• Documentation and release notes updated
• Public API, exports, declarations, stored format or runtime targets changed
• Infrastructure, dependencies or deployment configuration changed

Package versions and release baseline declarations follow current main (2.14.8 source manifests from #675). This PR introduces no independent version bump. Its original changelog note is retained in the current candidate section.

Verification

• Full workspace build and root health, lint, format and typecheck: pass. These four checks were repeated after formatting the merged changelog.
• After incorporating fix(wallet-toolbox): change the profile list only after the UMP update succeeds #675, complete affected CWI/profile, WAB, authentication, metadata/encryption/module/proxy/token suites: 10 suites / 259 tests pass. The original eight-row encryption table and token tests are unchanged.
• Earlier complete local wallet run on the first main integration (8199c6ca28): 295 suites / 3,251 tests pass, with existing 2 skipped suites / 7 skipped tests. After fix(wallet-toolbox): change the profile list only after the UMP update succeeds #675 landed, the complete affected 259-test regression batch was repeated on the final source. The new exact-head hosted wallet run below is required; the earlier full receipt is not relabelled as a final-head run.
• Latest-source client/mobile units, BTMS/ECPM and wallet-helper tests pass. All other affected dependents passed locally on the first integration; fresh final-head hosted dependent checks remain required.
• Conformance: 6,497 tests pass; 211 existing governed skips.
• All three wallet packed-consumer checks and browser/mobile platform contracts: pass.
• Documentation generation/checks and site build/link checks: pass; migration ledger generated by its original generator. Changed-file formatting and git diff --check: pass.
• Hosted exact-head CI, CodeQL, and Conformance pass on 4c69a2c33016ea443cdaff6941ed7c68d31bdb5e. All 44 checks are terminal: 37 successful, 7 scope skips validated by the successful merge gate. Final-head full wallet coverage (all regular shards, both HTTP sync jobs and monitor), all affected dependents and all platform/consumer jobs pass. Sonar: quality=OK, newFindings=0, unreviewedHotspots=0. PR-ref CodeQL alerts: none.
• Coverage delta: changed-line/branch coverage 100.00% (15/15 points; required target 90.00%). No threshold, suppression or exclusion change.
• Complete diff reviewed; original runtime/tests preserved and current-main changes retained
• All applicable exact-head checks terminal and successful, with scope skips validated by merge gate

Security and dependencies

• No dependency, lockfile, override, suppression, exclusion or skipped-test change
• Original negative/regression encryption coverage retained
• Exact-head CodeQL has no new alert
• Exact-head Sonar reports zero new findings and unreviewed hotspots

Dependency evidence

No dependency change. Security audit passes with 3 low and 2 moderate existing advisories, none high/critical. Existing peer contracts and package exports are unchanged; packed consumer and platform checks pass.

Release and operations

• No npm publication, image release or deployment performed
• Existing changelog, migration and release clauses preserved

No API, wire or database migration. The fix prevents future normal-basket double encryption. Existing affected values retain the original single-decrypt read behavior. There is no live-wallet access or database rewrite.

Completion evidence

• All exact-head hosted checks passed
• Review conversations resolved
• Documentation and release guidance reflect the original fix
• No pending or failed check handed off as complete
• Existing GitHub maintainer approval is retained from the prior head; no new review request or merge is performed here.

Current with main, conflict-free and ready for review after exact-head qualification. Deggen’s original implementation/tests remain unchanged. No PR merge, publication or deployment performed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[BraydenLangley]

Makes sense