ensureSeedReady

Returns the wallet's BIP-39 seed, deriving it from the user's passkey via PRF if not already cached. See class-level KDoc for the full bootstrap contract.