Correct a dead reference in the Speculos README, and propose changelog entries

[buzzromain]

Two documentation changes. The first is a plain correction and needs no
decision; the second is a proposal, and the file it touches is yours. If the
second opens a discussion, say so and I will split it out — the README fix
should not wait on it.

1. A dead reference in tests/speculos/README.md

This one is a regression of mine. #160 renamed tests/functional/genericlayout.py
to choicelist.py and dropped its touch-coordinate table, since the four
"choose among N" screens became one SDK BARS_LIST and ragger's own
ChoiceList knows where its rows are. The "Adapting to stax/apex" section
still said:

tests/functional/keypad.py and genericlayout.py have the equivalent
stax/apex positions if this needs extending

Wrong twice over: the file does not exist, and the positions are gone with it.
The search for references to the removed module was run over src/ and
tests/ as code, not over the README.

What the section says now was read out of the files rather than deduced:

• keypad.py still has three tables — STAX, FLEX and APEX_P, twelve
  keys each — so it is still worth borrowing from, and the section still
  points at it.
• choicelist.py is names only (MENU_CHECK, WORDS_12, …). No coordinates
  at all. Extending these scripts past flex means measuring the rows on the
  device, not copying a table.

2. Changelog entries for the interface work — proposed, not imposed

The [1.9.0] section was last touched on 28 June, in "Port to Ledger Nano
Gen5". Everything since — the four-way menu, the explanations and warnings,
the pre-generate review, PIN derivation, the separate result screens, the list
component — is absent from it.

Four things I deliberately did not do, because the file's own history says
they are yours:

• The header date is untouched. [1.9.0] - 2026-06-28 is exactly as you
  left it. Redating it is your gesture, in your release commit — it is what
  3710295 did, and RELEASE_POLICY.md puts the changelog update inside the
  release procedure.
• No Unreleased section. The word has never appeared in this file, and
  adding one would impose a convention you have not chosen.
• The file's own words. journey, verdict and secret never appear in
  this changelog; flow and screen do. Entries use those, keep on-screen
  text in single quotes as 1.7.3 and 1.7.4 do, reserve backticks for code
  identifiers, and stay under 112 characters — the longest line the file has.
• Nothing is removed or reordered. Every entry is appended at the end of
  its category, so dropping one is a single-line deletion.

Changed is reopened, not invented. Three of the twelve lines alter
behaviour rather than repair it — the list component and the menu entries, the
button labels, and the values the two SSKR screens announce. Keep a Changelog
reserves Fixed for defects, and this file already carried ### Changed in
1.3.0, 1.3.2, 1.5.1, 1.5.2, 1.5.4, 1.6.1, 1.7.0 and 1.7.1; it goes between
Added and Fixed, the order the format lists. If you would rather 1.9.0 keep
the three sections it has, say so and the three lines go back under Fixed.

Twelve lines, not a hundred. 108 merges landed in this window. The filter
was what would someone upgrading from 1.8.0 notice — not what changed in the
tree. Nothing test-side, build-side or CI-side is listed, which is most of it.
Each line maps to a merged PR:

Line	Section	PR
Add an explanation to the backup, recovery and BIP85 flows, and a warning	Added	#158
Add a review of the chosen values, and of the BIP85 derivation path	Added	#158
Add PIN derivation, as BIP85's DICE application	Added	#159
Add a separate result screen when a valid phrase or share set does not match	Added	#153
Add advice on Flex and Stax to check length, order and spelling	Added	#153
Change the menu and phrase length screens to SDK lists	Changed	#157, #160
Say which values are accepted on the share count and threshold screens	Changed	#156
Label the reject buttons 'Cancel' and 'Close' rather than 'Done'	Changed	#154
Name the whole set on each generated SSKR share	Fixed	#155
Return to the screen that asked, when a share count or threshold is refused	Fixed	#156
Make the seed comparison result survive a single bit flip	Security	#135
Erase the whole SSKR share entry buffer, and the BIP39 word candidates	Security	#158

Ten of the twelve were read off a running device — flex under Speculos, the
binary rebuilt from this branch, driven through all four flows. 'SSKR Share 1 of 3', Check length, order and spelling, (1 - 16), (2 - 3), Cancel and
Close are quoted from the screen, not from a diff. The two Security lines
cannot be: they are memory facts, which is what the GDB checks in
tests/speculos/ exist for.

Wording is a proposal — change any of it. Three choices worth naming so you can
overrule them knowingly:

• Nothing that BIP-85 gained inside this cycle is listed as changed. BIP-85
  ships in 1.9.0, so its index screen, its password-length screen and its
  secret list have never been in a release: to someone upgrading from 1.8.0
  they are simply part of the feature, not modifications of it. For the same
  reason the DICE truncation (bip85: compute dice bits_per_roll as ceil(log2(sides)) (#60) #66, bip85: fix DICE roll truncation with bounded DRNG re-extension #71), the unterminated base64 password
  (bip85: NUL-terminate the base64 password before %s #70) and the Nano S deferred work (fix: run the work Nano S defers, so its seed check can finish #111) are absent — they fix code nobody
  has run. If you would rather the section record the work than the
  user-visible delta, they belong in.
• The device names are dropped where a change covers the whole touch
  stack. The existing lines say "on Flex and Stax", but since "Port to Ledger
  Nano Gen5" that would now understate the reach; 59 of the file's 89 entries
  name no device at all.
• The two Security lines are not user-visible, unlike the other ten —
  they follow the precedent of "Wipe text buffers on Stax and Flex as early as
  possible", which already sits in that section.

Not fixed here, and worth its own change

tests/speculos/verify_sskr_share_cancel_clears_buffer.py carries the same
stale reference in a comment (lines 85-86), and the problem there is not the
comment. It hardcodes a three-entry tool-select screen at
(240, 540)/(240, 430)/(240, 320), counted bottom-up, and taps (240, 430)
expecting "SSKR Check" to lead straight to the keyboard. After #157, #158 and
#160 that screen has four entries, is drawn top-down by the SDK, and the flow
now passes an explanation screen first. The script needs re-driving, not a
comment edit — that is code, and this PR touches no code.