ensureSdk
Build the SDK for config, or reuse the live one if config is unchanged. On a config change, the previous SDK is closed (its subscriptions cancelled) before the new one is built.
Called by the config authority (wallet panel). Triggers the seed bootstrap on first build — i.e. the biometric prompt — via WalletSeedSource.ensureSeedReady.
Throws
if no passkey is forged yet (propagated from the seed source).