fix: build hashes and recovery-phrase entropy come from ethers (closes #758)

build.js and script/lib/package.js hash with sha256 from ethers, with the
0x prefix stripped so the build receipt and SHA256SUMS keep bare lowercase
hex. generateMnemonic() takes its 16 bytes of entropy from randomBytes in
ethers. The README Crypto policy no longer lists these as exceptions.

Model: opus-5-5

README.md

@@ -1645,11 +1645,9 @@ The development dependencies ship nowhere:
 
 ### Crypto policy
 
-Hashing, key derivation, signing and encryption go through `ethers` or
-`libsodium-wrappers-sumo`. No primitive is implemented in this repository. A new
-recovery phrase draws its random bytes from the browser's
-`crypto.getRandomValues()`. The build tooling, `build.js` and `script/lib/`,
-hashes files with Node's `crypto`; none of it ships in the extension.
+Hashing, random bytes, key derivation, signing and encryption go through
+`ethers` or `libsodium-wrappers-sumo`. This holds for the build tooling as well
+as the extension. No primitive is implemented in this repository.
 
 ### Content Security Policy