chore(custodian)!: derive the rng ikm straight from HKDF

[samlaf]

Part of SEI-222

get_rng_ikm derived its 64 bytes as HKDF(root_key) -> MiniSecretKey -> expand(Uniform) -> secret bytes. The schnorrkel step is a leftover of the original VRF-based RNG design: no schnorrkel cryptography is performed with the result, and every consumer already narrows it to a raw [u8; 64]. It now takes those 64 bytes from the purpose derivation itself.

This changes the rng key on every network that has a root key, and RNG-precompile outputs are consensus, so re-found any running TEE devnet across the change rather than upgrading it in place. A network with no root key runs the well-known ikm literal (#262) and never reaches this derivation; the live testnet is one of those and is unaffected.

expand_purpose is now the crate's only deriver: 32 bytes for every purpose, 64 for RngPrecompile. That retires the last schnorrkel use in production code, so the crate drops the dependency and schnorrkel stays only as seismic-crypto's dev-dependency, without the serde feature nothing asked for.

The derivation also stops being public API. Key, KeyPurpose and derive_purpose_key leave the crate's surface, which is now exactly one way out per defined key: get_tx_io_sk, get_tx_io_pk, get_rng_ikm and get_snapshot_key hand a caller its key in that key's own type, and write_luks_keyfile exports the LUKS pair, whose bytes no in-process caller ever holds. Nothing outside the crate imported the removed items.

Two things fall out of that:

• Key had one job left, scrubbing root_key, and that needs no named type: Custodian derives ZeroizeOnDrop over a plain [u8; 32]. The vacuous Result on derive_purpose_key, its .expect at three call sites, and get_snapshot_key's length try_into go with it.
• write_luks_keyfile assembles both LUKS keys into one buffer that leaves as a file. The buffer is now Zeroizing, so the copy this process keeps is scrubbed once the write lands.

[linear-code]

SEI-222