fix: build hashes and recovery-phrase entropy come from ethers (closes #758)

build.js and script/lib/package.js hash with sha256 from ethers, with the
0x prefix stripped so the build receipt and SHA256SUMS keep bare lowercase
hex. generateMnemonic() takes its 16 bytes of entropy from randomBytes in
ethers. The README Crypto policy no longer lists these as exceptions.

Model: opus-5-5

README.md

@@ -1647,11 +1647,10 @@ The development dependencies ship nowhere:
 
 ### Crypto policy
 
-Hashing, key derivation, signing and encryption go through `ethers` or
-`libsodium-wrappers-sumo`. No primitive is implemented in this repository. A new
-recovery phrase draws its random bytes from the browser's
-`crypto.getRandomValues()`. The build tooling, `build.js` and `script/lib/`,
-hashes files with Node's `crypto`; none of it ships in the extension.
+In the extension, hashing, key derivation, signing and encryption go through
+`ethers` or `libsodium-wrappers-sumo`. A new recovery phrase takes its random
+bytes from `ethers`. `build.js` and `script/lib/package.js` also hash files with
+`ethers`. No primitive is implemented in this repository.
 
 ### Content Security Policy