deriveFromPrfOutput

Pure derivation: 32-byte PRF output → DID string. No ceremony, no biometric, no Credential Manager.

Used by orchestrators that already ran a (possibly multi-salt) PRF assertion and need to convert the result into a DID without a second ceremony. Implementations are deterministic in the input; the same PRF output always yields the same DID.