fix: build hashes and recovery-phrase entropy come from ethers (closes #758)

build.js and script/lib/package.js hash with sha256 from ethers, with the
0x prefix stripped so the build receipt and SHA256SUMS keep bare lowercase
hex. generateMnemonic() takes its 16 bytes of entropy from randomBytes in
ethers. The README Crypto policy no longer lists these as exceptions.

Model: opus-5-5

build.js

@@ -1,8 +1,8 @@
 const fs = require("fs");
 const path = require("path");
-const crypto = require("crypto");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
+const { sha256 } = require("ethers");
 const { resolveVersion } = require("./script/lib/version");
 const {
     BACKGROUND_ENTRY_PREFIX,
@@ -314,10 +314,8 @@ function copyIcons(distDir) {
 }
 
 function sha256File(absPath) {
-    return crypto
-        .createHash("sha256")
-        .update(fs.readFileSync(absPath))
-        .digest("hex");
+    // ethers prefixes the hex with 0x; the receipt holds bare hex.
+    return sha256(fs.readFileSync(absPath)).slice(2);
 }
 
 // Write the receipt for the files this build emitted. Deliberately records no