StarkWare Shields STRK20 Via Companion, Not Native Signature

StarkWare shipped compliance with confidential pool STRK20 via companion account instead of native is_valid_signature. Companion uses standard account, $0 at rest, mainnet tx 0x31f84064cff15b6278acd2f949799e0880d4ed1edde11696d543d4e1e4a6c8f succeeded. Avoids re-audit and migration. Finding: privacy spending key must not derive from rotating owner keys—use WebAuthn PRF anchor.