security: make CSPRNG wake and reboot reseeding non-repeating

[forkwright]

Finding

Phase-08 planning proposed a passphrase-derived stable thumos-csprng-v1 key as a deterministic wake reseed. Reinitializing a stream generator from the same key/counter can repeat output across wakes or reboots. The kernel currently derives/stores that key but does not feed it into the CSPRNG, so the dangerous contract is planned rather than yet wired.

Evidence

• crates/thumos/src/key_manager.rs: HKDF derives a stable CSPRNG reseed key from the master key.
• crates/thumos/src/csprng.rs: current readiness/reseed uses its entropy-pool path and does not consume that key.
• Phase-08 REQ-01a described deterministic reseed without a monotonic epoch, fresh credited entropy, or repetition/backtracking contract.
• Jitter-band entropy crediting counts the deterministic tick increment, so a constant-delta timer can satisfy the seed gate #840 owns false entropy credit in the current timer/jitter seed gate, not wake-state uniqueness.

Why this matters

Repeated DRBG state can repeat nonces, ephemeral keys, randomized identities, and secrets across power cycles. A stable secret may be one extractor input, but it cannot by itself make a reset state fresh.

Done when

• Define a versioned DRBG instantiate/reseed design with domain separation, fresh credited entropy and/or an authenticated non-repeating persisted epoch, and explicit crash/rollback behavior.
• Never restart a stream at a repeated key/counter state; persist or derive state atomically and fail closed when freshness cannot be established for key/nonce generation.
• Separate prediction resistance, backtracking resistance, readiness, and availability claims.
• Tests cover repeated wake/reboot, identical master keys, rollback/clone, interrupted state update, unavailable entropy/storage, counter exhaustion, and output non-repetition.
• Integrate with Jitter-band entropy crediting counts the deterministic tick increment, so a constant-delta timer can satisfy the seed gate #840's corrected entropy-credit mechanism and Phase-08 audit/rollback policy before any M7 qualification.