Signing:
- signData no longer takes a metadata argument. The encoding/JSON-schema
  validation and the Algorand tag-prefix check were removed; it signs exactly
  the bytes given. SignMetadata, Encoding, ERROR_BAD_DATA and
  ERROR_TAGS_FOUND are no longer exported, and ajv/algo-msgpack-with-bigint
  are no longer runtime dependencies. Callers signing untrusted data must
  domain-separate it (e.g. as ARC-60 does).
- signAlgoTransaction rejects input not prefixed with "TX" by throwing
  TxTagMissingError, catching an encoded transaction passed in place of its
  bytes to sign.

Fixes:
- deriveChildNodePublic rejects harden(0) (previously returned a wrong key).
- Import bip32-ed25519 with its .js extension instead of a ts-expect-error.
- README test vectors regenerated; the previous ones did not match the
  library's output. A test now checks the README vectors.
- Await rejected-promise assertions in tests so failures are reported.
- build/test clean dist first so stale spec files are never packed.

Packaging and tooling:
- Only the package root is importable (package.json "exports").
- Test-only libsodium helpers (kx, secretbox, keypair, sk_to_curve25519,
  to_base64) move from sumo.facade.ts to src/test-utils, outside the
  published build; @noble/ciphers becomes a dev dependency.
- Switch from yarn to pnpm; update CI to Node 22/24 and current actions;
  bump dev dependencies (TypeScript 6, Jest 30, semantic-release 25).

Use the platform's WebCrypto (crypto.subtle) for SHA-512, SHA-256, HMAC,
X25519 and Ed25519 verification. Keep @noble only for what WebCrypto lacks:
unclamped Ed25519 point arithmetic for BIP32-Ed25519, Ed25519 -> X25519 key
conversion (@noble/curves), and BLAKE2b (@noble/hashes). Replace Buffer and
bn.js with plain Uint8Array/bigint helpers so the published build has no
Node globals. Runtime dependencies drop from six to two.

Key derivation, signatures and ECDH outputs are byte-identical to the
previous implementation. verifyWithPublicKey keeps libsodium's strict rules
(canonical S, R and public key; small-order points rejected) regardless of
the platform's WebCrypto edge-case behaviour.

API changes since 2.0.0-canary.1:
- fromSeed is async and accepts any Uint8Array.
- signData no longer takes a metadata argument. Encoding/JSON-schema
  validation and the Algorand tag-prefix check were removed; it signs
  exactly the bytes given. SignMetadata, Encoding, ERROR_BAD_DATA and
  ERROR_TAGS_FOUND are no longer exported. Callers signing untrusted data
  must domain-separate it (e.g. as ARC-60 does).
- signAlgoTransaction rejects input not prefixed with "TX" by throwing
  TxTagMissingError, catching an encoded transaction passed in place of its
  bytes to sign.
- deriveChildNodePublic rejects harden(0) (previously returned a wrong key).
- Only the package root is importable (package.json "exports").
- Requires Node.js >= 22, a browser with WebCrypto Ed25519/X25519, or a
  WebCrypto polyfill on React Native.

Also:
- README test vectors regenerated; the previous ones did not match the
  library's output. A test now checks the README vectors.
- Switch from yarn to pnpm; update CI to Node 22/24 and current actions.
- build/test clean dist first so stale spec files are never packed.

Closes algorandfoundation/xHD-Wallet-API-ts#33