derivePrfMaterial

One-shot derive that returns BOTH the 32-byte BIP-39 entropy and the 64-byte BIP-39 seed from a single PRF authentication.

Use this when both halves are needed (e.g. storing a PlaintextSeed which carries entropy + seed together) — calling derivePrfEntropy then deriveBip39Seed would trigger two biometric prompts because each call re-runs Credential Manager.

Caller MUST wipe both arrays once the consumer has copied them — call PrfSeedMaterial.wipe or wipe the fields directly.