Scan any EVM wallet address or ENS name for on-chain risk signals using Web3 Antivirus. Returns a toxic score, risk level, and the specific risk categories that triggered a flag. Designed for off-ramp compliance: use shouldFlag to block or escalate — any non-zero toxic score means the wallet has been flagged for at least one risk category such as sanctions, scams, mixers, or phishing.