fix(sdk-coin-stx): verify recipient and amount in native STX verifyTransaction

[bitgo-ai-agent-dev]

What

• Stx.verifyTransaction previously returned true after checking only that the recipient count was ≤ 1 — no address or amount comparison was performed.
• Added full decode-and-compare logic ported from Sip10Token.verifyTransaction:
  • Decodes the prebuild txHex via explainTransaction
  • Compares the decoded recipient address (memoId stripped) and amount against txParams.recipients
  • Compares the memo (from txParams.memo or embedded in recipient address) against the decoded transaction memo
  • Validates total output amount matches the declared total
• Added getMemoIdAndBaseAddressFromAddress import from existing utils
• Added lodash import (already a listed dependency) for _.isEqual
• Added 8 new unit tests covering: valid match, wrong address, wrong amount, wrong memo, missing txHex, and multiple recipients

Why

• A compromised platform prebuild could redirect native STX sends to any address or alter the amount, and the local verifyTransaction would still return true without detecting the mismatch.
• The SIP10 token path already had full recipient validation; this gap was specific to native STX.
• This is a security fix required by the Claude Security scan (High severity).

Test plan

• All 180 existing unit tests pass (cd modules/sdk-coin-stx && mocha)
• New tests verify correct recipient/amount match returns true
• New tests verify wrong address, wrong amount, wrong memo all throw descriptive errors
• New test verifies missing txHex in prebuild throws an error
• TypeScript compilation succeeds for sdk-coin-stx with no new errors

Ticket: CSHLD-839

[linear-code]

CSHLD-839