Derive from the mnemonic's words joined by single spaces (closes #49)

The BIP-39 seed was computed over the mnemonic string as given, with only its ends trimmed, so the same words one per line, tab-separated or double-spaced passed the checksum but gave different keys with no warning. The words are now joined by single spaces before the checksum and the seed, for every source: the mnemonic command, both environment variables and the prompt. Single-spaced input gives the same keys as before; a test checks the README vector for each spacing.

Model: opus-5-5

internal/cli/cli_test.go

@@ -47,6 +47,25 @@ func TestTheReadmeTestVectors(t *testing.T) {
 	)
 }
 
+func TestTheSpacingBetweenTheWordsDoesNotChangeTheKeys(t *testing.T) {
+	words := strings.Fields(example())
+
+	for name, spaced := range map[string]string{
+		"one word per line": strings.Join(words, "\n"),
+		"double spaces":     strings.Join(words, "  "),
+		"tabs":              strings.Join(words, "\t"),
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(mnemonic.Variable, spaced)
+
+			require.Equal(t,
+				vectorZero+" keyfunc/ssh/0",
+				strings.TrimSpace(run(t, "ssh", "pub", "-n", "0")),
+			)
+		})
+	}
+}
+
 func TestTheCommentCanBeChosen(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 

internal/mnemonic/mnemonic.go

@@ -104,10 +104,11 @@ func ask() (string, error) {
 	return checked(string(typed))
 }
 
-// checked drops the surrounding whitespace and refuses a mnemonic that
-// does not pass the BIP-39 checksum.
+// checked joins the words with single spaces, whatever whitespace
+// separated them, since the seed is computed over the string itself,
+// and refuses a mnemonic that does not pass the BIP-39 checksum.
 func checked(words string) (string, error) {
-	words = strings.TrimSpace(words)
+	words = strings.Join(strings.Fields(words), " ")
 
 	if !bip39.IsMnemonicValid(words) {
 		return "", ErrChecksum