service_identity.go + hybrid.go are pure-function, I/O-free derivation (BIP-39
-> BIP-32 -> ML-DSA-65 NodeID) that imports only luxfi/crypto + go-bip32/39 +
ids — NO kms import, so no keys<->kms cycle. Previously these lived only
vendored-in-kms; consumers (hanzoai/kms/sdk, bank, kms-operator) referenced
keys.ServiceIdentity/NewServiceIdentity that the released keys lacked. This is
the canonical home. (LoadMnemonic stays out of keys — it needs kms/zapclient.)
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
