deriveFromPrfOutput
Pure derivation — 32-byte PRF output is consumed as the Ed25519 seed, the corresponding public key is encoded as did:key:z6Mk….
The seed is consumed in this method only; the caller owns wiping the input. Used by both deriveSigilDid (with its own ceremony) and SigilSession (with the shared multi-salt ceremony).