Rob Hamilton used the Kimmy K3 open-weight model to identify the Coldcard firmware vulnerability within five minutes