[huggingbot]

Explanation

Pin CubistEscrowProvider's default C2F version to v10 (cubist-secret-escrow release 0.1.0) instead of the moving latest alias so recovery operations consistently invoke the intended escrow release.

• Preserve the existing version option for callers that explicitly select another version.
• Update the assertions for ping, challenge generation, mutation, and secret retrieval.
• Document the pinned default in the provider options, architecture guide, and changelog.

References

• Related to feat: align MFA recovery with Auth API approvals #10883.

Validation

• Passed the provider suite: 49 tests.
• Passed the complete @metamask/mfa-recovery-controller suite: 203 tests across 6 files.
• Passed Oxlint on both changed TypeScript files and Oxfmt on all four changed files.
• Passed package-only type checking: yarn exec tsc --project packages/mfa-recovery-controller/tsconfig.lint.json --noEmit.
• Passed all changelog validation: yarn changelog:validate:all.
• The dependency-inclusive type-check (yarn exec tsc --build packages/mfa-recovery-controller/tsconfig.lint.json) reports unrelated errors in dependency test files, including json-rpc-engine, keyring-controller, geolocation-controller, remote-feature-flag-controller, and profile-sync-controller.
• Full-monorepo tests and lint were not run.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them