feat(keystore): sealed real/duress slots (argon2id 16MiB/3, ChaCha20-Poly1305), torn-write-safe 2-copy record, wipe state; virtio-rng driver + Entropy port; RustCrypto deps

Cargo.toml

@@ -14,6 +14,9 @@ members = [
     "crates/domain",
     "crates/elf",
     "crates/manifest",
+    "crates/keystore",
+    "crates/ports/entropy",
+    "crates/drivers/rng/virtio",
     "crates/tools/app-image",
     "crates/init",
     "crates/kernel",
@@ -72,6 +75,14 @@ types = { path = "crates/types" }
 domain = { path = "crates/domain" }
 elf = { path = "crates/elf" }
 manifest = { path = "crates/manifest" }
+keystore = { path = "crates/keystore" }
+# Audited RustCrypto implementations; never our own.
+argon2 = { version = "0.5", default-features = false }
+chacha20poly1305 = { version = "0.10", default-features = false }
+blake2 = { version = "0.10", default-features = false }
+zeroize = { version = "1", default-features = false }
+port-entropy = { path = "crates/ports/entropy" }
+driver-rng-virtio = { path = "crates/drivers/rng/virtio" }
 platform = { path = "crates/platform" }
 kernel = { path = "crates/kernel" }
 server-framework = { path = "crates/server-framework" }