Signing:
- signData no longer takes a metadata argument. The encoding/JSON-schema
  validation and the Algorand tag-prefix check were removed; it signs exactly
  the bytes given. SignMetadata, Encoding, ERROR_BAD_DATA and
  ERROR_TAGS_FOUND are no longer exported, and ajv/algo-msgpack-with-bigint
  are no longer runtime dependencies. Callers signing untrusted data must
  domain-separate it (e.g. as ARC-60 does).
- signAlgoTransaction rejects input not prefixed with "TX" by throwing
  TxTagMissingError, catching an encoded transaction passed in place of its
  bytes to sign.

Fixes:
- deriveChildNodePublic rejects harden(0) (previously returned a wrong key).
- Import bip32-ed25519 with its .js extension instead of a ts-expect-error.
- README test vectors regenerated; the previous ones did not match the
  library's output. A test now checks the README vectors.
- Await rejected-promise assertions in tests so failures are reported.
- build/test clean dist first so stale spec files are never packed.

Packaging and tooling:
- Only the package root is importable (package.json "exports").
- Test-only libsodium helpers (kx, secretbox, keypair, sk_to_curve25519,
  to_base64) move from sumo.facade.ts to src/test-utils, outside the
  published build; @noble/ciphers becomes a dev dependency.
- Switch from yarn to pnpm; update CI to Node 22/24 and current actions;
  bump dev dependencies (TypeScript 6, Jest 30, semantic-release 25).

fix: moved files to truly hidden folder

docs: update account close-out rules for consensus v43