docs(keystore): document default-account-only limitation of sealed signing

TWStoredKeySign / Keystore::sealedSign derive at the coin's DEFAULT derivation
and DEFAULT account only. A custom derivation path or a non-default account is
not yet supported — such a wallet would be signed with the default account's
key and would not match its address. Record this as an explicit follow-up:

- TWStoredKey.h: \note on the TWStoredKeySign contract
- SealedSigner.cpp: TODO(S2.1 follow-up) at the derivation site

Also add tools/run-sealed-tests to build + run the sealed-signing tests locally.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: PandaXadnaP

include/TrustWalletCore/TWStoredKey.h

@@ -362,6 +362,10 @@ struct TWPrivateKey* _Nullable TWStoredKeyPrivateKey(struct TWStoredKey* _Nonnul
 /// \param password Non-null block of data, password of the stored key
 /// \param input Non-null block of data, serialized SigningInput protobuf (without a private key)
 /// \note Returned object needs to be deleted with \TWDataDelete
+/// \note LIMITATION (S2.1): the key is derived at the coin's DEFAULT derivation and DEFAULT account.
+///       A custom derivation path or a non-default account is NOT yet supported — signing such a
+///       wallet here uses the default account's key and will not match its address. Passing the
+///       derivation/path through to wallet-core is a planned S2.1 follow-up.
 /// \return Null pointer on failure or if the coin is not supported by the sealed path; serialized SigningOutput otherwise
 TW_EXPORT_METHOD
 TWData* _Nullable TWStoredKeySign(struct TWStoredKey* _Nonnull key, enum TWCoinType coin, TWData* _Nonnull password, TWData* _Nonnull input);

src/Keystore/SealedSigner.cpp

@@ -42,6 +42,12 @@ Data sealedSign(StoredKey& storedKey, TWCoinType coin, const Data& password, con
     // (1) Decrypt + derive the signing key ONCE, inside the library.
     //     (Account-based coins need a single key; the UTXO multi-key path — decrypt once, derive
     //      many from the in-memory HDWallet — is added in a later increment.)
+    //
+    // TODO(S2.1 follow-up): this derives at the coin's DEFAULT derivation and DEFAULT account only.
+    //   A custom derivation path or a non-default account is not yet threaded through, so signing
+    //   such a wallet uses the default account's key and won't match its address. Add a
+    //   derivation/path parameter (see claude-handoff-S2-UTXO-sealed-sign-findings.md) so callers on
+    //   custom paths / multi-account wallets are supported.
     PrivateKey privateKey = storedKey.privateKey(coin, password);
 
     // (2) Inject the key into the coin's SigningInput proto.

tools/run-sealed-tests

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# Build the C++ tests and run the sealed-signing (Security Layer S2.1) tests.
+#
+# Usage:
+#   tools/run-sealed-tests                 # run *SealedSigner* + *TWStoredKeySign*
+#   tools/run-sealed-tests "*Ethereum*"    # custom gtest filter
+#
+set -e
+
+cd "$(dirname "$0")/.."
+
+# cmake needs BOOST_ROOT (brew boost) on macOS; make rust/protoc reachable for fresh shells.
+if command -v brew >/dev/null 2>&1; then
+  export BOOST_ROOT="${BOOST_ROOT:-$(brew --prefix boost 2>/dev/null)}"
+fi
+export PATH="/opt/homebrew/opt/rustup/bin:$HOME/.cargo/bin:$PWD/build/local/bin:$PATH"
+
+FILTER="${1:-*SealedSigner*:*TWStoredKeySign*}"
+
+# Configure once if the build tree isn't there yet.
+if [ ! -f build/CMakeCache.txt ]; then
+  cmake -H. -Bbuild -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
+fi
+
+make -Cbuild -j12 tests
+./build/tests/tests --gtest_filter="$FILTER"