feat: add key retirement status UI and voluntary exit panel

.github/workflows/malware-scan.yml

@@ -22,6 +22,7 @@ jobs:
         env:
           BASE: ${{ github.base_ref }}
         run: |
+          set -uo pipefail
           git fetch origin "$BASE"
           FINDINGS=""
 
@@ -35,12 +36,12 @@ jobs:
           done < <(git diff "origin/$BASE"...HEAD -- \
             '*.config.js' '*.config.ts' '*.config.cjs' '*.config.mjs' \
             'package.json' '.vscode/*.json' \
-            | grep '^+[^+]')
+            | grep '^+[^+]' || true)
 
           # 2. eval() or spawn() in config files — should never appear there
           HITS=$(git diff "origin/$BASE"...HEAD -- \
             '*.config.js' '*.config.ts' '*.config.cjs' '*.config.mjs' \
-            | grep '^+[^+]' | grep -E 'eval\s*\(|spawn\s*\(' || true)
+            | grep '^+[^+]' | grep -E 'eval\s*\(|spawn\s*\(' || true)
           if [[ -n "$HITS" ]]; then
             FINDINGS="${FINDINGS}- \`eval()\` or \`spawn()\` found in a config file
 "
@@ -109,10 +110,9 @@ jobs:
           fi
 
           # 10. Known PolinRider marker strings
-          MARKERS=$(git diff "origin/$BASE"...HEAD | grep '^+[^+]' \
-            | grep -F 'rmcej%otb%' || \
-            git diff "origin/$BASE"...HEAD | grep '^+[^+]' | grep -F 'Cot%3T=sthP' || \
-            git diff "origin/$BASE"...HEAD | grep '^+[^+]' | grep -F '_$__1e42' || true)
+          DIFF_ADDED=$(git diff "origin/$BASE"...HEAD | grep '^+[^+]' || true)
+          MARKERS=$(printf '%s\n' "$DIFF_ADDED" \
+            | grep -F -e 'rmcej%otb%' -e 'Cot%3T=sthP' -e '_$__1e42' || true)
           if [[ -n "$MARKERS" ]]; then
             FINDINGS="${FINDINGS}- Known PolinRider marker string detected (\`rmcej%otb%\`, \`Cot%3T=sthP\`, or \`_\$__1e42\`)
 "
@@ -155,8 +155,7 @@ jobs:
                 '2. Scan your machine for malware immediately',
                 '3. Rotate your GitHub token and all other credentials stored on that machine',
                 '4. Recreate your branch from the latest default branch and re-apply only your own changes',
-              ].join('
-')
+              ].join('\n')
             });
 
       - name: Fail if malware detected

src/components/common/KeyBuybackModal.tsx

@@ -186,7 +186,10 @@ export default function KeyBuybackModal({
 
 							<div className="flex items-center justify-between">
 								<span className="text-white/60">Total XLM Payout</span>
-								<span className="font-bold text-emerald-400 tabular-nums text-base">
+								<span
+									className="font-bold text-emerald-400 tabular-nums text-base"
+									data-testid="buyback-amount-received"
+								>
 									{formatNumber(
 										receipt.totalPayoutStroops / STROOPS_PER_XLM,
 										{

src/components/common/KeyDeprecationBanner.tsx

@@ -58,6 +58,7 @@ export default function KeyDeprecationBanner({
 		: 'Guaranteed open window';
 
 	const hasHoldings = holdingsCount > 0;
+	const showBuybackConfirmed = Boolean(recentSettlement);
 	const estimatedValueXlm =
 		(holdingsCount * buybackPriceStroops) / STROOPS_PER_XLM;
 
@@ -75,7 +76,7 @@ export default function KeyDeprecationBanner({
 					<div className="flex flex-wrap items-center gap-2.5">
 						<span className="inline-flex items-center gap-1.5 rounded-full border border-amber-500/40 bg-amber-500/20 px-2.5 py-0.5 text-xs font-semibold text-amber-300">
 							<AlertTriangle className="size-3.5" aria-hidden="true" />
-							<span>Key Deprecated</span>
+							<span>{showBuybackConfirmed ? 'Buyback Confirmed' : 'Key Deprecated'}</span>
 						</span>
 						<span className="text-xs font-medium text-amber-200/70">
 							Guaranteed Contract Buyback Active

src/components/common/KeyFreezeStatusBanner.tsx

@@ -17,10 +17,6 @@ interface KeyFreezeStatusBannerProps {
 	className?: string;
 }
 
-/** Admin contact link shown in the banner when a freeze needs escalation. */
-export const FREEZE_SUPPORT_URL =
-	'https://github.com/accesslayerorg/accesslayer-client/issues';
-
 function formatExpiry(iso: string, expiresAtMs: number | null): string {
 	if (expiresAtMs === null) return iso;
 	return new Date(expiresAtMs).toLocaleString(undefined, {
@@ -85,7 +81,7 @@ export default function KeyFreezeStatusBanner({
 				<p className="mt-1 text-sm text-white/70">
 					Buying and selling are disabled until the freeze is lifted.{' '}
 					<a
-						href={FREEZE_SUPPORT_URL}
+						href="https://github.com/accesslayerorg/accesslayer-client/issues"
 						target="_blank"
 						rel="noreferrer"
 						data-testid="key-freeze-contact-link"

src/components/common/LockupCountdown.tsx

@@ -58,7 +58,7 @@ export const LockupCountdown: React.FC<LockupCountdownProps> = ({
 			data-testid="lockup-countdown"
 			aria-label={`Lockup remaining: ${formattedTime}`}
 		>
-			<Clock className="size-3.5 shrink-0 text-amber-400 animate-pulse" />
+			<Clock className="size-3.5 shrink-0 text-amber-400 animate-pulse" aria-hidden="true" />
 			<span className="font-mono tabular-nums" data-testid="lockup-timer-text">
 				{formattedTime}
 			</span>