Key Ceremony (Custody / Wallet Provisioning)

Derive a root seed from QRNG + OS via HKDF, expand with a DRBG, and produce an audit-ready attestation.