feat(keystore): sealed real/duress slots (argon2id 16MiB/3, ChaCha20-Poly1305), torn-write-safe 2-copy record, wipe state; virtio-rng driver + Entropy port; RustCrypto deps

crates/ports/entropy/Cargo.toml

@@ -0,0 +1,6 @@
+[package]
+name = "port-entropy"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]

crates/ports/entropy/src/lib.rs

@@ -0,0 +1,10 @@
+//! Where randomness comes from: keys, salts, nonces.
+
+#![no_std]
+#![forbid(unsafe_code)]
+
+pub trait Entropy {
+    /// Fills `buf` with random bytes from the hardware; false if it could
+    /// not (then nothing in `buf` may be used).
+    fn fill(&mut self, buf: &mut [u8]) -> bool;
+}