isLegacyP256
True when did uses the legacy P-256 multicodec encoding.
Used by SigilStateStore to detect installations that were forged before the PRF-derived Ed25519 migration and need their sigil state wiped + re-derived on next launch.
Prefix-only check (did:key:zDn) — fast, doesn't decode base58. Safe because base58btc + the P-256 multicodec prefix deterministically produces a zDn… prefix (see DidKeyGeneratorTest).