Remove cbk and mnemonic commands from sutil

sutil holds only the utilities wanted on every machine; it is not a
command-line front end for the packages in pkg/. cbk and bip39wordlist
remain libraries with no CLI surface. The README states the boundary.

README.md

@@ -4,8 +4,8 @@
 
 `sneak.berlin/go/x` is a WTFPL-licensed Go module and CLI tool by
 [@sneak](https://sneak.berlin) that serves as an umbrella publishing space for
-small reusable packages, plus `sutil`, a command-line utility that exposes them
-from the shell.
+small reusable packages, plus `sutil`, a command-line utility holding a few
+small tools worth having on every machine.
 
 Importable packages live in `pkg/`. The CLI is `cmd/sutil/`, and the code that
 exists only to support it lives in `internal/`.
@@ -39,15 +39,6 @@ sutil generate random --count 1073741824 "my seed" > testdata.bin
 sutil generate password
 # marble7-sprout2-velvet9
 
-# A new 24-word BIP39 mnemonic phrase (or --words 12).
-sutil generate mnemonic
-
-# A crypto_box keypair derived from a mnemonic. The mnemonic is read from
-# stdin, never from the command line, so it stays out of shell history.
-sutil generate mnemonic > mnemonic.txt
-sutil cbk derive < mnemonic.txt
-sutil cbk derive --public < mnemonic.txt
-
 # Build metadata, including which config file (if any) was loaded.
 sutil version
 sutil info
@@ -228,12 +219,14 @@ sutil
 ├── info                    print version, Go version, module, VCS metadata
 ├── generate (gen)
 │   ├── random [seedstr]    stream pseudorandom bytes (--count N to stop)
-│   ├── password (pw)       print a memorable password
-│   └── mnemonic            print a new BIP39 mnemonic (--words N)
-└── cbk
-    └── derive              keypair from a mnemonic on stdin (--public)
+│   └── password (pw)       print a memorable password
 ```
 
+`sutil` is not a command-line front end for the packages in `pkg/`. It holds
+only the handful of utilities the author wants available everywhere. `pkg/cbk`
+and `pkg/bip39wordlist` are libraries with no CLI surface, and a command is
+added because a tool is wanted, not because a package exists.
+
 ### Build, test, and CI
 
 The `Makefile` is the single entry point: `make test` (30-second timeout, quiet
@@ -275,10 +268,6 @@ make docker     # the full CI build
       `exhaustruct`, and replaces the deprecated `gomodguard` with
       `gomodguard_v2`. With `default: all`, newer images enable `exhaustruct_v5`
       and fail every partial struct literal.
-- [ ] Add `sutil cbk seal` and `sutil cbk open` so messages can be sealed and
-      opened from the shell, not just from Go.
-- [ ] Let `sutil cbk derive` take the BIP39 passphrase from an environment
-      variable; the library supports it, the CLI does not expose it yet.
 
 ## License