Add BRC-157 entropy backups to BSVCompat

[rohenaz]

Summary

• add BRC157Entropy to opt-in BSVCompat, where the SDK's BIP-39/BIP-32 primitives already live
• validate BIP-39 entropy as a secp256k1 scalar and preserve all five standard entropy lengths
• generate new wallets from uniform 32-byte private-key scalars (24 words)
• split/recover the left-padded entropy key through BRC-140 without ever using that backup subject to sign
• derive BRC-100 profile roots at hardened m/0'/i', with profile zero at m/0'/0'
• redact mnemonic/entropy diagnostics and document nonempty passphrases as a separate unrecoverable secret

This belongs in the SDK rather than ToolboxWallet: BRC-157 composes reusable BIP-39, BIP-32, secp256k1, and BRC-140 primitives and has no concrete wallet/storage behavior.

BRC-140 alignment

Review found two pre-existing deviations in the Swift BRC-140 helper, corrected here because BRC-157 relies on it:

• coordinate generation now makes exactly the normative five attempts
• recovery requires common threshold/integrity metadata, then uses the first threshold shares and ignores later shares as BRC-140 specifies; duplicate x-coordinates remain rejected inside the used quorum

Local TypeScript and Go source use the same first-threshold recovery semantics. Their retry loops perform one unused sixth draw before throwing but never accept it; Swift stops after the normative fifth failure.

Entropy-length safety

Imported 12/15/18/21-word entropy is left-padded for BRC-140. Exact restoration therefore requires trusted, authenticated entropyByteCount metadata. Too-small lengths that discard nonzero bytes are rejected, but a too-large supported length can absorb genuine zero padding and produce a different valid mnemonic/root. The API and README state this explicitly; wallet restore must also verify the expected identity key.

Verification

• focused BRC-140 + BRC-157 suites: 24 passed
• complete SDK suite: 814 passed
• all hard-coded root/profile/passphrase vectors independently reproduced with PBKDF2/BIP-32 arithmetic
• scalar zero/order boundaries, all BIP-39 lengths, share recovery, ambiguity, passphrases, and diagnostic redaction covered
• git diff --check

The live Go oracle could not launch because the local Go 1.25 toolchain verification fails while GOSUMDB=off; static Go/TypeScript reference comparison and all local tests completed.

[rohenaz]

Independent standards pass against BRCs/key-derivation/0157.md and the current BRC-140 text at head f0a35088: no P1/P2 mismatch found. Entropy length/scalar validation, fixed-width padding, exact mnemonic recovery, two-level hardened BIP-32 profile derivation, identity-safe diagnostics, five coordinate attempts, and first-quorum share recovery match the specs. All eight fresh macOS/Linux/Go/BigNum checks are green. The changed BRC-140 semantics are deliberate and spec-backed, not an incidental BRC-157 workaround.