DriveKey Hinkal local-proof workflow candidate

Uses the original Blender-rendered glass headings from the other chat.
Offline signing request/response format and all spending workers are unchanged.
The swap screen explains the new return-to-Windows local proving step.

On the website, prepare a fresh ETH-to-USDC swap and retain both the unsigned
request and encrypted proof recovery file. Sign only the exact reviewed request
in the offline OS. Return to the same browser, unlock viewing access, import the
request and signed response, and choose Generate local proofs. The provider
prepare job does not need to survive the offline trip. The signed deadline,
slippage, accepted root and unspent checks still apply. Never reuse an old swap.

This is an unfunded integration candidate. It does not extend the old pilot
approval to the new image or qualify the full-proof relayer. Signed companion
funded submission remains disabled pending exact release/round-trip checks.

No physical USB was read or written by this build. The single-USB image has an
empty exchange partition; do not flash it over your existing wallet USB.
SHA256SUMS covers both the ISO and single-USB image.