The Coldcard Collapse: How a Five-Year-Old RNG Flaw Let an Attacker Sweep 594 BTC in 25 Minutes