feat(kyc-controller): throw on previously silently handled errors

[jiexi]

Explanation

• BREAKING: checkKycRequired and the consents-path session (#startConsentsSession via acceptTermsAndStartSession / a resumed initialize) now rethrow the original error after writing it to controller state.
• A product-scoped MoonPay auto-run therefore rejects handleFrameMessage / onAuthenticated when the KYC-required check fails, instead of only setting phase: 'error'.
• In-flight failures after reset() still do not write state or rethrow. Validation #fail + return (missing email/token/country) is unchanged.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Breaking public API for KycController consumers that assumed resolved promises on KYC check and consents-session failures; behavior change in MoonPay post-auth auto-run error propagation.

Overview
BREAKING: Several KYC controller paths that used to fail quietly now rethrow the original error after writing failure details to state, so callers can use try/catch or await rejection handling instead of only inspecting phase / error.

checkKycRequired still sets phase: 'error' on service failure but no longer returns false; it propagates the error. On product-scoped MoonPay flows, that means onAuthenticated / frame-message continuation rejects when the auto KYC-required check fails, while startSumSub failures remain swallowed in that continuation (state-only).

The consents-path session (#startConsentsSession, reached from acceptTermsAndStartSession or a resumed initialize) still rewinds to terms and records a consents error, then rethrows so Iron/non-MoonPay session failures surface to the caller.

Tests and JSDoc/changelog document the new throw behavior; validation via #fail (missing token/email/country) and superseded in-flight work after reset() are unchanged.

^{Reviewed by Cursor Bugbot for commit 740420d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jiexi]

@metamaskbot publish-previews

[jiexi]

@metamaskbot publish-preview