we can postulate a rational coin-holder would never construct a transaction with more inputs than required."
I don't think this is necessarily true, a user may create transactions with unnecessary inputs in order to confuse such privacy-attacking heuristics. It is in the user's interest to retain some privacy, after all.
Privacy is complicated, but if ...
A Mimblewimble blockchain relies on two complementary aspects to provide security: Pedersen Commitments and range proofs (in the form of Bulletproof range proofs). Bulletproofs do not require a trusted setup. They rely only on the discrete logarithm assumption, and are made non-interactive using the Fiat-Shamir heuristic.
Pedersen Commitments provide ...
Chain analysis companies use many heuristics to link addresses into wallets.
The most popular being:
common input heuristic where all addresses are grouped by the premise of being inputs to the same transaction
change analysis heuristic which looks at the transaction outputs trying to group them by recipient and change address
other methods, like grouping ...
It is possible to use the trezor command line client trezorctl available here to install a firmware you downloaded from trezor as described in the developer docs here.
BE SURE YOU HAVE A BACKUP OF YOUR SEED
"1) Pick version of firmware binary listed on https://wallet.trezor.io/data/firmware/1/releases.json
2) Download it: wget -O trezor.signed.bin https://...
does this mean that the person I bought the 0.1 BTC from now can track exactly how I spend it?
Lets imagine a scenario with three parties: Me, You and the chocolate factory. If I sell you 0.001 BTC, can I tell if you spend it on chocolate?
It's the early days of Bitcoin and I also like chocolate.
I use my wallet and send 0.001 BTC from my address III to ...
All Bitcoin transactions are public information, and each transaction is uniquely identifiable via its txid. Each piece of bitcoin (called a transaction output) is uniquely identifiable as well by means of the transaction that created it, and the index of the output on the transaction. This makes the "outpoint" txid:vout the unique identifier of a UTXO.