restoreSeed

Sign in with an existing passkey — the post-PRF replacement for the old "restore from cloud" flow.

What changed. Pre-PRF this method:

1. Pulled an encrypted blob from Block Store

2. Decrypted it to recover (seed, sigil triple, appMetadata)

3. Wrote the seed into SeedVault

4. SIGKILL'd the process so the wallet panel rebuilt cleanly

Post-PRF none of (1)–(4) is necessary for the SIGIL ITSELF:

• The seed derives from PRF(passkey, SEED_SALT) — WalletSeedSource handles that on the next wallet action, no blob needed.

• The sigil DID derives from PRF(passkey, SIGIL_SALT) via SigilIdentityProvider — that's what step 1 below does.

• The SDK lives on a stable PRF-derived seed regardless of how long ago the user last authenticated, so no SIGKILL needed.

The Block Store blob is now narrower in scope: it carries only the host-app's metadata (Kicks's match state, etc.). Step 2 below pulls it through to the registered AppDataBackupProvider when a blob is available; absent or v1-legacy blobs are silently tolerated.