OFAC / sanctions screening for a wallet address. Compliance-sensitive callers should gate on `sanctions_status === "clean"`, not `is_sanctioned === false`.